{"resultsPerPage":1042,"startIndex":0,"totalResults":1042,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-25T03:32:29.788","vulnerabilities":[{"cve":{"id":"CVE-2026-92928","sourceIdentifier":"contact@securifera.com","published":"2026-09-23T00:16:59.773","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4.\n\nUpgrade to version 3.5.4."}],"affected":[{"source":"contact@securifera.com","affectedData":[{"vendor":"OpenEye","product":"Apex Network Video Recorder (NVR)","defaultStatus":"unknown","versions":[{"version":"3.2.9.376","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@securifera.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:59:32.425297Z","id":"CVE-2026-92928","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"contact@securifera.com","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://portal.openeye.net/updates/issue-alerts/1058","source":"contact@securifera.com"},{"url":"https://www.securifera.com/advisories/","source":"contact@securifera.com"}]}},{"cve":{"id":"CVE-2026-92929","sourceIdentifier":"contact@securifera.com","published":"2026-09-23T00:17:00.897","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4.\n\nUpgrade to version 3.5.4."}],"affected":[{"source":"contact@securifera.com","affectedData":[{"vendor":"OpenEye","product":"Apex Network Video Recorder (NVR)","defaultStatus":"unknown","versions":[{"version":"3.2.9.376","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@securifera.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:58:43.938282Z","id":"CVE-2026-92929","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"contact@securifera.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://portal.openeye.net/updates/issue-alerts/1059","source":"contact@securifera.com"},{"url":"https://www.securifera.com/advisories/","source":"contact@securifera.com"}]}},{"cve":{"id":"CVE-2026-92930","sourceIdentifier":"contact@securifera.com","published":"2026-09-23T00:17:01.080","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and use it to reset the administrator password. The underlying design has been present since at least firmware 2.2.3.4.\n\nUpgrade to version 3.5.4."}],"affected":[{"source":"contact@securifera.com","affectedData":[{"vendor":"OpenEye","product":"Apex Network Video Recorder (NVR)","defaultStatus":"unknown","versions":[{"version":"3.2.9.376","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@securifera.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.3,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:40:55.835162Z","id":"CVE-2026-92930","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"contact@securifera.com","type":"Secondary","description":[{"lang":"en","value":"CWE-330"}]}],"references":[{"url":"https://portal.openeye.net/updates/issue-alerts/1060","source":"contact@securifera.com"},{"url":"https://www.securifera.com/advisories/","source":"contact@securifera.com"}]}},{"cve":{"id":"CVE-2026-94367","sourceIdentifier":"contact@securifera.com","published":"2026-09-23T00:17:01.200","lastModified":"2026-09-26T12:17:35.413","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4.\n\nThis vulnerability is resolved in OpenEye Apex version 3.4.3."}],"affected":[{"source":"contact@securifera.com","affectedData":[{"vendor":"OpenEye","product":"Apex Network Video Recorder (NVR)","defaultStatus":"unknown","versions":[{"version":"3.2.9.376","status":"affected"},{"version":"3.4.3","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@securifera.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:44:23.711465Z","id":"CVE-2026-94367","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"contact@securifera.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://portal.openeye.net/updates/issue-alerts/1061","source":"contact@securifera.com"},{"url":"https://www.securifera.com/advisories/","source":"contact@securifera.com"}]}},{"cve":{"id":"CVE-2026-95829","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T00:17:01.333","lastModified":"2026-09-26T01:17:03.067","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TDuckCloud","product":"tduck-platform","cpes":["cpe:2.3:a:tduckcloud:tduck-platform:*:*:*:*:*:*:*:*"],"modules":["Pagination Inner Interceptor"],"versions":[{"version":"5.0","status":"affected"},{"version":"5.1","status":"affected"},{"version":"5.2","status":"affected"},{"version":"5.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:13:37.993491Z","id":"CVE-2026-95829","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/TDuckCloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95829","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/897248","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408522","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408522/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95830","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T00:17:01.537","lastModified":"2026-09-23T15:17:30.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /post_upload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"theRealSain","product":"Pixtream","cpes":["cpe:2.3:a:therealsain:pixtream:*:*:*:*:*:*:*:*"],"versions":[{"version":"866afd4f0cea812b918780fb74b67dccf8c4d6a0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:56:56.510566Z","id":"CVE-2026-95830","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/yingxiujie/cve/issues/11","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95830","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/897169","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408523","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408523/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95833","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T00:17:01.743","lastModified":"2026-09-23T15:17:30.993","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Leave Management System","cpes":["cpe:2.3:a:itsourcecode:leave_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:30:39.161439Z","id":"CVE-2026-95833","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit_repository/issues/16","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95833","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953126","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408524","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408524/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95868","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T00:17:01.937","lastModified":"2026-09-23T17:17:22.097","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the function mysqli_query of the file admin/display_menu.php of the component Search Form. This manipulation of the argument s1 causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"AdithyaYelloju","product":"Restaurant-Management-System","cpes":["cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"],"modules":["Search Form"],"versions":[{"version":"7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:22:04.514448Z","id":"CVE-2026-95868","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95868","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953178","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408542","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408542/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953178","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95897","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T01:16:31.920","lastModified":"2026-09-23T15:17:31.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Dask","cpes":["cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*"],"modules":["Loader"],"versions":[{"version":"2026.0","status":"affected"},{"version":"2026.1","status":"affected"},{"version":"2026.2","status":"affected"},{"version":"2026.3","status":"affected"},{"version":"2026.4","status":"affected"},{"version":"2026.5","status":"affected"},{"version":"2026.6","status":"affected"},{"version":"2026.7","status":"affected"},{"version":"2026.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:01:12.785179Z","id":"CVE-2026-95897","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/dask/dask/","source":"cna@vuldb.com"},{"url":"https://github.com/dask/dask/issues/12578","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95897","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953281","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408543","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408543/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95924","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T01:16:32.110","lastModified":"2026-09-26T01:17:03.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:16:21.704117Z","id":"CVE-2026-95924","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/huliangjia/cve/issues/4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95924","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953303","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408546","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408546/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95925","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T01:16:32.293","lastModified":"2026-09-23T15:17:31.293","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=update. The manipulation of the argument difficulty_id results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:56:24.862926Z","id":"CVE-2026-95925","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/huliangjia/cve/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95925","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953304","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408547","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408547/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96271","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T01:16:32.477","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"photoview","product":"photoview","defaultStatus":"unaffected","repo":"https://github.com/photoview/photoview","packageURL":"pkg:github/photoview/photoview","versions":[{"version":"0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:14:53.755232Z","id":"CVE-2026-96271","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/photoview/photoview","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/blob/81affea602401c2f0207d955919ddcc0670a9222/api/graphql/models/actions/share_token_actions.go#L64-L82","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/commit/20541762fe6d9e0ce363c3d4c55556e4ccdc57a2","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/issues/1494","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/photoview-through-2.4.0-authorization-bypass-via-sharealbum","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96272","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T01:16:32.633","lastModified":"2026-09-26T01:17:03.667","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"MacWarrior","product":"clipbucket-v5","defaultStatus":"unaffected","repo":"https://github.com/MacWarrior/clipbucket-v5","packageURL":"pkg:github/MacWarrior/clipbucket-v5","versions":[{"version":"0","lessThan":"5.5.3-#182","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:15:09.512418Z","id":"CVE-2026-96272","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/MacWarrior/clipbucket-v5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/blob/57b0235f2eae390f4946c042bf81c182a9f82782/upload/includes/classes/photos.class.php#L408-L413","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/commit/7fd0af6f8b5826c2d6ef0976dbb1867f5c36b707","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/pull/874","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/sqli-photo-seach-clipbucketv5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/clipbucket-v5-before-5.5.3-182-sql-injection-via-search-result-php","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/sqli-photo-seach-clipbucketv5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96273","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T01:16:32.790","lastModified":"2026-09-28T17:17:53.210","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"NationalSecurityAgency","product":"ghidra","defaultStatus":"unaffected","repo":"https://github.com/NationalSecurityAgency/ghidra","packageURL":"pkg:github/NationalSecurityAgency/ghidra","versions":[{"version":"0","lessThan":"12.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:46:33.318445Z","id":"CVE-2026-96273","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-460"},{"lang":"en","value":"CWE-667"}]}],"references":[{"url":"https://github.com/NationalSecurityAgency/ghidra","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.3_build/Ghidra/Framework/Project/src/main/java/ghidra/framework/data/OptionsDB.java#L358-L366","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/594da048431aab082a9da7c4a965874d07d33310","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.4_build","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4w7g-wmg8-fgv5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ghidra-before-12.1.4-denial-of-service-via-crafted-database","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-95926","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T02:16:54.527","lastModified":"2026-09-23T15:17:31.440","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update. This manipulation of the argument test_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:30:27.302568Z","id":"CVE-2026-95926","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/huliangjia/cve/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95926","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953308","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408548","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408548/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95927","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T02:16:55.537","lastModified":"2026-09-23T18:17:11.757","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument test_id leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:47:44.169970Z","id":"CVE-2026-95927","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/huliangjia/cve/issues/8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95927","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953309","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408549","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408549/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95928","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T02:16:55.717","lastModified":"2026-09-23T14:57:49.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"recommenders-team","product":"recommenders","cpes":["cpe:2.3:a:recommenders-team:recommenders:*:*:*:*:*:*:*:*"],"modules":["Dict Loading"],"versions":[{"version":"1.2.0","status":"affected"},{"version":"1.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:50:57.392964Z","id":"CVE-2026-95928","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/recommenders-team/recommenders/","source":"cna@vuldb.com"},{"url":"https://github.com/recommenders-team/recommenders/issues/2368","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95928","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953327","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408550","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408550/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-89425","sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","published":"2026-09-23T03:17:04.357","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}],"affected":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","affectedData":[{"vendor":"FasterXML","product":"jackson-core","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"com.fasterxml.jackson.core:jackson-core","programRoutines":[{"name":"com.fasterxml.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}],"repo":"https://github.com/FasterXML/jackson-core","versions":[{"version":"2.8.0","lessThanOrEqual":"2.18.10","versionType":"maven","status":"affected"},{"version":"2.19.0","lessThanOrEqual":"2.21.6","versionType":"maven","status":"affected"},{"version":"2.22.0","lessThanOrEqual":"2.22.2","versionType":"maven","status":"affected"}]},{"vendor":"FasterXML","product":"jackson-core","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"tools.jackson.core:jackson-core","programRoutines":[{"name":"tools.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}],"repo":"https://github.com/FasterXML/jackson-core","versions":[{"version":"3.0.0","lessThanOrEqual":"3.1.6","versionType":"maven","status":"affected"},{"version":"3.2.0","lessThanOrEqual":"3.2.2","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:54:51.050132Z","id":"CVE-2026-89425","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/FasterXML/jackson-core/pull/1698","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91776","sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","published":"2026-09-23T03:17:04.620","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}],"affected":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","affectedData":[{"vendor":"FasterXML","product":"jackson-databind","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"com.fasterxml.jackson.core:jackson-databind","programRoutines":[{"name":"com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer"}],"repo":"https://github.com/FasterXML/jackson-databind","versions":[{"version":"2.0.0","lessThanOrEqual":"2.18.10","versionType":"maven","status":"affected"},{"version":"2.19.0","lessThanOrEqual":"2.21.6","versionType":"maven","status":"affected"},{"version":"2.22.0","lessThanOrEqual":"2.22.2","versionType":"maven","status":"affected"}]},{"vendor":"FasterXML","product":"jackson-databind","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"tools.jackson.core:jackson-databind","programRoutines":[{"name":"tools.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer"}],"repo":"https://github.com/FasterXML/jackson-databind","versions":[{"version":"3.0.0","lessThanOrEqual":"3.1.6","versionType":"maven","status":"affected"},{"version":"3.2.0","lessThanOrEqual":"3.2.2","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:02:42.582789Z","id":"CVE-2026-91776","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/issues/6203","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91777","sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","published":"2026-09-23T03:17:04.783","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}],"affected":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","affectedData":[{"vendor":"FasterXML","product":"jackson-databind","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"com.fasterxml.jackson.core:jackson-databind","programRoutines":[{"name":"com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference"},{"name":"com.fasterxml.jackson.databind.deser.std.MapDeserializer.MapReferringAccumulator.resolveForwardReference"}],"repo":"https://github.com/FasterXML/jackson-databind","versions":[{"version":"2.5.0","lessThanOrEqual":"2.18.10","versionType":"maven","status":"affected"},{"version":"2.19.0","lessThanOrEqual":"2.21.6","versionType":"maven","status":"affected"},{"version":"2.22.0","lessThanOrEqual":"2.22.2","versionType":"maven","status":"affected"}]},{"vendor":"FasterXML","product":"jackson-databind","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"tools.jackson.core:jackson-databind","programRoutines":[{"name":"tools.jackson.databind.deser.jdk.CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference"},{"name":"tools.jackson.databind.deser.jdk.MapDeserializer.MapReferringAccumulator.resolveForwardReference"}],"repo":"https://github.com/FasterXML/jackson-databind","versions":[{"version":"3.0.0","lessThanOrEqual":"3.1.6","versionType":"maven","status":"affected"},{"version":"3.2.0","lessThanOrEqual":"3.2.2","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:04:51.226591Z","id":"CVE-2026-91777","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/issues/6204","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95929","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:05.263","lastModified":"2026-09-26T01:17:03.367","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"iFlytek","product":"astron-agent","cpes":["cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:*"],"modules":["getBotList API endpoint"],"versions":[{"version":"1.0.0","status":"affected"},{"version":"1.0.1","status":"affected"},{"version":"1.0.2","status":"affected"},{"version":"1.0.3","status":"affected"},{"version":"1.0.4","status":"affected"},{"version":"1.0.5","status":"affected"},{"version":"1.0.6","status":"affected"},{"version":"1.0.7","status":"affected"},{"version":"reward-1575","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:18:17.471709Z","id":"CVE-2026-95929","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/iflytek/astron-agent/","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/commit/6702be70ae802b1048f5fbec91e690e7b71a4165","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/issues/1329","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/pull/1342","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/releases/tag/reward-1575","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95929","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953330","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408551","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408551/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95930","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:05.483","lastModified":"2026-09-23T15:17:31.587","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"iFlytek","product":"astron-agent","cpes":["cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:*"],"modules":["debugToolV2 API endpoint"],"versions":[{"version":"1.0.0","status":"affected"},{"version":"1.0.1","status":"affected"},{"version":"1.0.2","status":"affected"},{"version":"1.0.3","status":"affected"},{"version":"1.0.4","status":"affected"},{"version":"1.0.5","status":"affected"},{"version":"1.0.6","status":"affected"},{"version":"reward-1575","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:53:43.906117Z","id":"CVE-2026-95930","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/iflytek/astron-agent/","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/commit/45ee5fb647e9894e73b0d7720fa94a66e4540bbb","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/issues/1323","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/pull/1338","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/releases/tag/reward-1575","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95930","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953331","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408552","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408552/cti","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/issues/1323","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95957","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:05.680","lastModified":"2026-09-23T15:17:31.773","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file student_signup.php of the component Self-Registration. Performing a manipulation of the argument full_name results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Smart Attendance System with QR Code Scanner","cpes":["cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"],"modules":["Self-Registration"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:30:15.111107Z","id":"CVE-2026-95957","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/Jack-MRJ/Smart-Attendance-System-with-QR-Code-Scanner","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95957","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953379","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408556","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408556/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95958","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:05.883","lastModified":"2026-09-23T18:17:11.913","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of the file manape/pe.cpp of the component PE Parser. Performing a manipulation of the argument BlockSize results in integer underflow. The attack requires a local approach. The patch is named c372b6bbca9d8c63812be50596fefa4a79c65fd0. It is recommended to apply a patch to fix this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"JusticeRage","product":"Manalyze","cpes":["cpe:2.3:a:justicerage:manalyze:*:*:*:*:*:*:*:*"],"modules":["PE Parser"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:N/I:N/A:P","baseScore":1.7,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"LOW","exploitabilityScore":3.1,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:49:14.873674Z","id":"CVE-2026-95958","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-189"},{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://github.com/JusticeRage/Manalyze/","source":"cna@vuldb.com"},{"url":"https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95958","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953395","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408568","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408568/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96257","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:06.077","lastModified":"2026-09-23T15:17:31.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Fast","product":"FAC1203R Gigabit Edition","cpes":["cpe:2.3:a:fast:fac1203r_gigabit_edition:*:*:*:*:*:*:*:*"],"modules":["Device Discovery Service"],"versions":[{"version":"2.0.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:06:54.550015Z","id":"CVE-2026-96257","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/vul-find-FAST_FAC1203R-copy_msg_element","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96257","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/901889","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408707","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408707/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96258","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T04:17:58.613","lastModified":"2026-09-26T01:17:03.527","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"onSite internet GmbH","product":"Auktion NG Auktionssoftware","cpes":["cpe:2.3:a:onsite_internet_gmbh:auktion_ng_auktionssoftware:*:*:*:*:*:*:*:*"],"modules":["Public Password Reset Endpoint"],"versions":[{"version":"20260722","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:19:04.859425Z","id":"CVE-2026-96258","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/CSDVi/cve/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96258","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/901875","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408708","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408708/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2022-4997","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:16:59.060","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"jet-form-builder-stripe-gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:44:01.446471Z","id":"CVE-2022-4997","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/368c38af-66c3-4500-ad50-87ada3abecd1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2025-15696","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:00.710","lastModified":"2026-10-14T19:10:00.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Real3D Flipbook  WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators."},{"lang":"es","value":"El plugin de WordPress Real3D Flipbook anterior a la versión 5.4 no sanea ni escapa varios campos del editor de flipbooks antes de renderizarlos de nuevo en el editor de administración, lo que permite a usuarios con el rol de Autor o superior inyectar scripts web arbitrarios que se ejecutan en el navegador de cualquier usuario que posteriormente abra el flipbook afectado para editarlo, incluidos los administradores."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Real3D Flipbook","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:44:16.188877Z","id":"CVE-2025-15696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7b454d8e-e2cd-4990-a72d-339b8065d359/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14321","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:00.850","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"divi-dash","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:45:15.568605Z","id":"CVE-2026-14321","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6f56b800-c8f6-4cd9-a137-c05b718db201/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-16264","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:00.963","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Newsletters","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.18.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:45:35.602362Z","id":"CVE-2026-16264","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0dd1de2d-e9bb-4c42-a78b-2643d43dfed6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-18364","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.073","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"zportals","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:45:45.654396Z","id":"CVE-2026-18364","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f1b6d694-e55a-42a8-8308-48ec158b26a5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-18365","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.193","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"zportals","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:45:54.508030Z","id":"CVE-2026-18365","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/752e218f-bd97-40d4-b32b-9e913b520db6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19438","sourceIdentifier":"cybersecurity@ch.abb.com","published":"2026-09-23T06:17:01.310","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I.\n\nThis issue affects Mint Workbench I: through 5876."}],"affected":[{"source":"cybersecurity@ch.abb.com","affectedData":[{"vendor":"ABB","product":"Mint Workbench I","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5876","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cybersecurity@ch.abb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cybersecurity@ch.abb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:09:43.306887Z","id":"CVE-2026-19438","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cybersecurity@ch.abb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://search.abb.com/library/Download.aspx?DocumentID=9AKK108473A3188&LanguageCode=en&DocumentPartId=&Action=Launch","source":"cybersecurity@ch.abb.com"}]}},{"cve":{"id":"CVE-2026-75799","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.710","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"YAHMAN Add-ons","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.9.31","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:05.241025Z","id":"CVE-2026-75799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b12397e7-5d9b-42bf-bd31-5d3401bc4600/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-77765","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.827","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Better Payment  WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Better Payment","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:19.942088Z","id":"CVE-2026-77765","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/932f8c74-1ded-40ee-b1fd-a328f3626f21/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-77766","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.933","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records.\n\nVersions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"8.5","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:31.280420Z","id":"CVE-2026-77766","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1b8acd9b-8309-4453-a7f7-61a463fe9ae1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-80342","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.040","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Payment Plugins for PayPal WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.27","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:40.282472Z","id":"CVE-2026-80342","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5c3eea0d-7f7f-48e5-8f78-c553b3fdeabf/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-81338","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.150","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:48.963456Z","id":"CVE-2026-81338","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e8494c71-fb0f-4ab9-a8b7-8db3745a2d9b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-81339","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.263","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:57.286810Z","id":"CVE-2026-81339","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f027d0b1-5d8a-4e80-adb3-bbf97dc53306/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82843","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.363","lastModified":"2026-09-24T14:43:01.483","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP OAuth Server ( Login with WordPress )","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:47:10.118793Z","id":"CVE-2026-82843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/45bc7096-5d04-4fe6-a332-31aed507a3a0/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-83555","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.483","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Email Subscribers & Newsletters  WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Email Subscribers & Newsletters","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.9.35","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:47:18.250423Z","id":"CVE-2026-83555","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/54cb2a98-7860-40dd-817e-1294317084aa/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84026","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.667","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"8.1","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:47:30.419547Z","id":"CVE-2026-84026","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4311f66d-f032-4753-88e8-2afbd5d73ebc/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84027","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.840","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"8.9.1","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:29.813763Z","id":"CVE-2026-84027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/dff1eca0-3fdd-4e7f-8ad2-1fa52b3b4a80/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84046","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.967","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:21.637445Z","id":"CVE-2026-84046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a5279c4b-ce91-4322-b5c3-70cd1d6d3ba8/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84098","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.070","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users.\n\nThis is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"3.1.0","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:13.034357Z","id":"CVE-2026-84098","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b5f83718-84ff-49e4-9ad7-395cc0ab494b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84150","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.173","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:00.544687Z","id":"CVE-2026-84150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c8e6b49b-874f-41d6-bff4-58e9fe559463/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84168","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.280","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Easy Hide Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:50.889102Z","id":"CVE-2026-84168","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/be4e40a1-8f2e-4c80-8615-77cc325c90b6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84741","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.383","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"The Events Calendar","defaultStatus":"unaffected","versions":[{"version":"4.5","lessThan":"6.17.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:40.662380Z","id":"CVE-2026-84741","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0f34a90e-3d8b-4a87-a2ed-fe4d2c481732/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84742","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.497","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"The Events Calendar","defaultStatus":"unaffected","versions":[{"version":"6.15.0","lessThan":"6.17.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:20.442604Z","id":"CVE-2026-84742","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f9228a51-1293-4a96-95da-0e57b7eb5f6b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84743","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.603","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"The Events Calendar","defaultStatus":"unaffected","versions":[{"version":"6.15.16.1","lessThan":"6.17.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","baseScore":3.8,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:10.909564Z","id":"CVE-2026-84743","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6c20337d-f485-491c-a380-38a3039af17d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-85006","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.703","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The HappyAddons for Elementor  WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"HappyAddons for Elementor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.50.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:01.226496Z","id":"CVE-2026-85006","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/50319e24-8ae8-40b8-9106-ed881359700e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86602","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.820","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Recipe Maker","defaultStatus":"unaffected","versions":[{"version":"10.3.0","lessThan":"10.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:41:51.276091Z","id":"CVE-2026-86602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/46324e95-20dc-465e-90ab-14bcbf136166/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86603","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.930","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Recipe Maker","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:41:34.015772Z","id":"CVE-2026-86603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f5eedd48-91a6-4216-9e96-32dfb7a23ee4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86608","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.030","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Recipe Maker","defaultStatus":"unaffected","versions":[{"version":"9.8.0","lessThan":"10.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:41:21.072442Z","id":"CVE-2026-86608","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d7f0f9dd-4180-4210-9c48-dae67e8f5d8e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86783","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.130","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Post Grid Gutenberg Blocks  WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Post Grid Gutenberg Blocks","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.0.41","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:39:47.271809Z","id":"CVE-2026-86783","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/719fc130-748b-4bad-8091-2858664299ed/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86785","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.233","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Social Commerce for WooCommerce","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:41.027335Z","id":"CVE-2026-86785","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9a4c36bd-c7f7-4068-ac73-b29ee66def96/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86842","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.343","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Real3D Flipbook  WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Real3D Flipbook","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:39:32.693971Z","id":"CVE-2026-86842","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b98713d1-e618-4728-baea-f26015e24b60/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87069","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.450","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms  WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Forminator Forms","defaultStatus":"unaffected","versions":[{"version":"1.38.1","lessThan":"1.57.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:39:22.942277Z","id":"CVE-2026-87069","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/cf14469d-eb14-4ab0-acdd-318a6c9d5d92/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87074","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.557","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms  WordPress plugin before 1.57.2.1 itself and can be replayed without limit."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Forminator Forms","defaultStatus":"unaffected","versions":[{"version":"1.17.1","lessThan":"1.57.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:39:07.818340Z","id":"CVE-2026-87074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/74ca7b28-25b7-4d68-ad4b-4785b1d2c666/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87979","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.657","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paymob for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.1.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:55.060045Z","id":"CVE-2026-87979","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/550a465c-4856-45bb-b609-0eaf1f2be660/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87981","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.760","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paymob for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.1.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:44.511250Z","id":"CVE-2026-87981","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/91c2d07f-0489-4b47-ac04-bc892d9fee5a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88929","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.860","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Product Badge, Label, Countdown Timer for WooCommerce  WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Product Badge, Label, Countdown Timer for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"7.0.0","lessThan":"7.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:34.066366Z","id":"CVE-2026-88929","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d6e10041-4171-4153-94bc-e8936be779c1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88997","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.967","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"JSM Show Post Metadata","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:22.858441Z","id":"CVE-2026-88997","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1699d3aa-29ca-4197-8e3b-0b03ecce751a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89331","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.083","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The FluentBoards  WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"FluentBoards","defaultStatus":"unaffected","versions":[{"version":"1.95","lessThan":"2.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:09.770375Z","id":"CVE-2026-89331","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d1aaacdf-7427-411f-b376-999793524a4b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-90951","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.210","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paid Membership Subscriptions  WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paid Membership Subscriptions","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:37:55.526356Z","id":"CVE-2026-90951","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/bf740af6-3674-461e-83f0-22bd5c5b3378/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-90985","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.317","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPC Smart Compare for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.6.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:37:45.793276Z","id":"CVE-2026-90985","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ff8a599b-e74f-485e-baf8-8d162633b2ea/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91024","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.417","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Booking Manager  WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Booking Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:37:23.430430Z","id":"CVE-2026-91024","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a5472152-0b96-4fc6-af90-2f1b01811237/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91025","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.523","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Booking Manager  WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager  WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager  WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Booking Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:37:12.873081Z","id":"CVE-2026-91025","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6e010e3e-78e8-4bfc-b880-d9a85cff2c2a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91073","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.630","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Subscribe Forms  WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Subscribe Forms","defaultStatus":"unaffected","versions":[{"version":"1.4.1","lessThan":"1.6.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:59.017689Z","id":"CVE-2026-91073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/50d0d5b6-2204-4af3-92d5-75085ce2f176/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91077","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.737","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Event Booking Manager for WooCommerce  WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Event Booking Manager for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"5.3.6","lessThan":"5.7.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:48.669150Z","id":"CVE-2026-91077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9db8d1c4-2bf8-4259-b95f-b131fc385a2e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93507","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.843","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WC Fields Factory","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.1.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:38.282362Z","id":"CVE-2026-93507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/21569537-3a83-4df1-a6c2-8ca720e71586/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93508","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.950","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WC Fields Factory","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.1.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:28.017418Z","id":"CVE-2026-93508","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a927f6d6-90d8-4b91-aed4-f5f53d2b5c64/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93510","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:06.057","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Points and Rewards for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.10.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:17.110125Z","id":"CVE-2026-93510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b721d8bb-2426-4635-a419-07074168bd82/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93511","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:06.163","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Premium Packages  WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Premium Packages","defaultStatus":"unaffected","versions":[{"version":"7.0.0","lessThan":"7.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:07.526399Z","id":"CVE-2026-93511","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://wpscan.com/vulnerability/edc2f15c-a72b-47c2-ad38-e6f5a8441d72/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93528","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:06.273","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"NP Quote Request for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"2.0","lessThan":"2.4.16","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:55.272788Z","id":"CVE-2026-93528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f691b9cc-7d17-4308-9646-db842d99f63f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-5924","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T07:16:45.720","lastModified":"2026-09-23T15:17:14.737","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval() on user-controlled block content in the frontend JavaScript mapStyles() function.  This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"jetmonsters","product":"Getwid – Gutenberg Blocks","defaultStatus":"unaffected","versions":[{"version":"2.1.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:10:04.811246Z","id":"CVE-2026-5924","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/getwid/tags/2.1.3/assets/blocks/map/frontend.js#L4","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/getwid/tags/2.1.3/includes/blocks/google-map.php#L139","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/getwid/trunk/assets/blocks/map/frontend.js#L4","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/getwid/trunk/includes/blocks/google-map.php#L139","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3514403%40getwid&new=3514403%40getwid","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0db9693-df56-44d3-9167-c21e868c3f88?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-6831","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T07:16:45.883","lastModified":"2026-09-23T15:17:16.347","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"vsourz1td","product":"Advanced Contact form 7 DB","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:13:08.060494Z","id":"CVE-2026-6831","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3587196%40advanced-cf7-db%2Ftags%2F2.1.2&old=3510776%40advanced-cf7-db%2Ftags%2F2.1.1","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c5fe0b-8a22-4df2-9adf-b6a7fe1a8a8c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-82331","sourceIdentifier":"security@apache.org","published":"2026-09-23T07:16:46.493","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious source tarballs to write files on the host, with the privileges of the user running BuildStream, via symlinks as part of source fetching.\nThe impact of this issue is mitigated by:\n\n* BuildStream projects should only use trusted sources in their elements as otherwise the build output can also not be trusted\n* Tracking a source tarball pins its SHA256 hash, which prevents MITM attacks of users that are fetching an already tracked project\n* When running on Python >= 3.12, BuildStream >= 2.3.0 already makes use of the Python `tarfile` filter functionality, which blocks the symlink escape\n\nUsers are recommended to upgrade to version 2.8.1, which fixes this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache BuildStream","defaultStatus":"unaffected","collectionURL":"https://pypi.python.org","packageName":"buildstream","packageURL":"pkg:pypi/BuildStream","versions":[{"version":"0","lessThanOrEqual":"2.8.0","versionType":"semver","status":"affected"},{"version":"2.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:55:37.367789Z","id":"CVE-2026-82331","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://lists.apache.org/thread/9b342631x7bvtyg0pq7zgywtl2cmy34v","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/9","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-50227","sourceIdentifier":"8fc372e3-d9c5-46e4-9410-38469745c639","published":"2026-09-23T08:17:09.383","lastModified":"2026-09-25T13:15:28.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context."}],"affected":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","affectedData":[{"vendor":"Acer","product":"NitroSense V5","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"*","lessThanOrEqual":"5.2.62","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:50:48.401965Z","id":"CVE-2026-50227","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://community.acer.com/en/kb/articles/20052","source":"8fc372e3-d9c5-46e4-9410-38469745c639"}]}},{"cve":{"id":"CVE-2026-50228","sourceIdentifier":"8fc372e3-d9c5-46e4-9410-38469745c639","published":"2026-09-23T08:17:10.493","lastModified":"2026-09-25T13:15:28.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution."}],"affected":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","affectedData":[{"vendor":"Acer","product":"NitroSense V5","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"*","lessThanOrEqual":"5.2.63","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:49:30.806462Z","id":"CVE-2026-50228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","type":"Secondary","description":[{"lang":"en","value":"CWE-489"}]}],"references":[{"url":"https://community.acer.com/en/kb/articles/20051","source":"8fc372e3-d9c5-46e4-9410-38469745c639"}]}},{"cve":{"id":"CVE-2026-91788","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:10.623","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:11:39.537445Z","id":"CVE-2026-91788","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-668"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-91789","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:10.753","lastModified":"2026-10-08T12:38:10.007","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. Under certain conditions, this could lead to an incorrectly sized memory allocation and a subsequent out-of-bounds write during pixel processing, potentially resulting in remote code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:14:41.947272Z","id":"CVE-2026-91789","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91790","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:10.873","lastModified":"2026-10-08T12:45:41.380","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:47:59.453112Z","id":"CVE-2026-91790","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91791","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:10.987","lastModified":"2026-10-08T12:52:52.453","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:47:41.583625Z","id":"CVE-2026-91791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91792","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.110","lastModified":"2026-10-08T13:20:31.513","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:47:21.562488Z","id":"CVE-2026-91792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91793","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.223","lastModified":"2026-10-08T13:47:43.337","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:08.057542Z","id":"CVE-2026-91793","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91794","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.337","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:58.965791Z","id":"CVE-2026-91794","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-91795","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.453","lastModified":"2026-10-08T13:48:36.860","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:41.289496Z","id":"CVE-2026-91795","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91796","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.570","lastModified":"2026-10-08T13:49:03.810","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:24.585625Z","id":"CVE-2026-91796","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91797","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.683","lastModified":"2026-10-08T13:49:35.017","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:25:36.693438Z","id":"CVE-2026-91797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91798","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.793","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:40:51.697713Z","id":"CVE-2026-91798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-91799","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.907","lastModified":"2026-10-08T13:50:42.047","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:42:27.568894Z","id":"CVE-2026-91799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91800","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.023","lastModified":"2026-10-15T15:06:29.017","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:45:25.566451Z","id":"CVE-2026-91800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.6.63484","matchCriteriaId":"92336E4D-D9B0-4629-97D6-028308036214"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.68868","versionEndIncluding":"14.0.7.69441","matchCriteriaId":"C887A2B3-8FF9-4F97-9580-D085BEDE7201"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.55583","versionEndIncluding":"2023.3.0.63083","matchCriteriaId":"D8785CCE-C44C-4908-9133-13A580D5BECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.63682","versionEndIncluding":"2024.4.1.66479","matchCriteriaId":"CF043D20-0E28-481C-8756-D1301FAE67D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.66692","versionEndIncluding":"2025.3.0.69570","matchCriteriaId":"20698FD4-5E28-4206-ACEA-4FCD24AD23BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.70169","versionEndIncluding":"2026.2.0.72029","matchCriteriaId":"72510597-6566-4748-8F69-099EBF8B5D21"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.72029","matchCriteriaId":"3EAB06EC-F222-463E-9441-0A6A2FC06288"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91801","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.133","lastModified":"2026-10-08T13:55:02.527","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:45:04.691075Z","id":"CVE-2026-91801","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91802","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.247","lastModified":"2026-10-08T13:56:03.950","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:42:49.234407Z","id":"CVE-2026-91802","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91803","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.363","lastModified":"2026-10-08T14:05:19.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:40:30.695753Z","id":"CVE-2026-91803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91804","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.477","lastModified":"2026-10-08T13:58:38.847","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:41:58.087529Z","id":"CVE-2026-91804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91805","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.583","lastModified":"2026-10-08T12:20:30.497","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:45:45.596189Z","id":"CVE-2026-91805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91806","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.693","lastModified":"2026-10-08T12:24:50.383","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:41:32.626461Z","id":"CVE-2026-91806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91807","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.807","lastModified":"2026-10-15T14:48:42.840","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:41:09.281583Z","id":"CVE-2026-91807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.2.63349","matchCriteriaId":"2C7DEE55-1FE3-4B41-975D-BB926E9E69D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.68868","versionEndIncluding":"14.0.7.69441","matchCriteriaId":"C887A2B3-8FF9-4F97-9580-D085BEDE7201"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.55583","versionEndIncluding":"2023.3.0.63083","matchCriteriaId":"D8785CCE-C44C-4908-9133-13A580D5BECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.63682","versionEndIncluding":"2024.4.1.66479","matchCriteriaId":"CF043D20-0E28-481C-8756-D1301FAE67D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.66692","versionEndIncluding":"2025.3.0.69570","matchCriteriaId":"20698FD4-5E28-4206-ACEA-4FCD24AD23BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.70169","versionEndIncluding":"2026.2.0.72029","matchCriteriaId":"72510597-6566-4748-8F69-099EBF8B5D21"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.1.39815","matchCriteriaId":"A6C4B75F-C060-4B92-9646-0E621DB9BF63"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91808","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.930","lastModified":"2026-10-08T13:53:24.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:25:57.837671Z","id":"CVE-2026-91808","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91809","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.070","lastModified":"2026-10-08T14:04:38.777","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:26:26.832912Z","id":"CVE-2026-91809","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91810","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.190","lastModified":"2026-10-08T14:04:13.797","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:39:59.611591Z","id":"CVE-2026-91810","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91811","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.307","lastModified":"2026-10-15T14:10:54.133","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:39:37.958469Z","id":"CVE-2026-91811","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.2.63349","matchCriteriaId":"2C7DEE55-1FE3-4B41-975D-BB926E9E69D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.68868","versionEndIncluding":"14.0.7.69441","matchCriteriaId":"C887A2B3-8FF9-4F97-9580-D085BEDE7201"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.55583","versionEndIncluding":"2023.3.0.63083","matchCriteriaId":"D8785CCE-C44C-4908-9133-13A580D5BECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.63682","versionEndIncluding":"2024.4.1.66479","matchCriteriaId":"CF043D20-0E28-481C-8756-D1301FAE67D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.66692","versionEndIncluding":"2025.3.0.69570","matchCriteriaId":"20698FD4-5E28-4206-ACEA-4FCD24AD23BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.70169","versionEndIncluding":"2026.2.0.72029","matchCriteriaId":"72510597-6566-4748-8F69-099EBF8B5D21"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.1.39815","matchCriteriaId":"A6C4B75F-C060-4B92-9646-0E621DB9BF63"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91812","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.423","lastModified":"2026-10-08T14:02:28.507","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":7.9,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:39:13.903098Z","id":"CVE-2026-91812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91813","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.550","lastModified":"2026-10-08T14:01:22.210","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:37:19.640678Z","id":"CVE-2026-91813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91814","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.673","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:24:09.232400Z","id":"CVE-2026-91814","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-91815","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.790","lastModified":"2026-10-08T14:00:25.370","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:24:42.700847Z","id":"CVE-2026-91815","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91816","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.900","lastModified":"2026-10-08T14:00:00.387","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:22:57.080981Z","id":"CVE-2026-91816","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91817","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:14.010","lastModified":"2026-10-01T20:23:59.847","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:22:00.125904Z","id":"CVE-2026-91817","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91818","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:14.123","lastModified":"2026-10-08T13:59:31.800","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:15:03.019532Z","id":"CVE-2026-91818","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-92378","sourceIdentifier":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","published":"2026-09-23T08:17:14.237","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A session management\nvulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware\nuniFLOW Online. Under specific timing conditions during Service Offline\nEmergency Mode, a previously authenticated session may be retained after\nlogout, which could allow a subsequent user to be authenticated as the previous\nuser and gain unauthorised limited access to device functionality."}],"affected":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","affectedData":[{"vendor":"NT-ware","product":"uniFLOW Online","defaultStatus":"unaffected","platforms":["Web Application"],"versions":[{"version":"0","lessThanOrEqual":"2026.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:48:32.843106Z","id":"CVE-2026-92378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://ntware.atlassian.net/wiki/spaces/SA/pages/14160592897/Security+Advisory+Previous+login+session+retained+when+entering+Reduced+Function+Login","source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"},{"url":"https://www.canon-europe.com/psirt/advisory-information/","source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}]}},{"cve":{"id":"CVE-2026-15027","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-23T09:17:07.657","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"Changing","product":"CGServiSign","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"1.0.23.1227","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:10:48.482227Z","id":"CVE-2026-15027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11214-89281-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11213-28a81-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-31377","sourceIdentifier":"security@apache.org","published":"2026-09-23T09:17:08.380","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.\n\n\n\nThe affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information.\n\n\n\nThis issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.\n\n\n\n\nUsers are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Doris","defaultStatus":"unknown","modules":["Frontend (FE) meta service"],"programFiles":["fe/fe-core/src/main/java/org/apache/doris/httpv2/meta/MetaService.java"],"versions":[{"version":"2.0.0","lessThan":"4.0.8","versionType":"semver","status":"affected"},{"version":"4.1.0","lessThan":"4.1.4","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.0.0","versionType":"semver","status":"unaffected"},{"version":"4.0.8","lessThan":"4.1.0","versionType":"semver","status":"unaffected"},{"version":"4.1.4","lessThan":"*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:06:33.070831Z","id":"CVE-2026-31377","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://lists.apache.org/thread/rf4ocqmzxvnwnxpsooj2lkzjl68b1m9q","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/10","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-42801","sourceIdentifier":"68630edc-a58c-4cbd-9b01-0e130455c8ae","published":"2026-09-23T09:17:08.727","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation.\n\nThis vulnerability is associated with program file 3g.mod/lib/src/urrsir.c."}],"affected":[{"source":"68630edc-a58c-4cbd-9b01-0e130455c8ae","affectedData":[{"vendor":"ASR","product":"Crane，Falcon","defaultStatus":"unaffected","modules":["as_rrc"],"platforms":["Linux"],"programFiles":["3g.mod/lib/src/urrsir.c"],"versions":[{"version":"0","lessThan":"2026/9/20","versionType":"date","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"68630edc-a58c-4cbd-9b01-0e130455c8ae","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:25:08.195447Z","id":"CVE-2026-42801","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"68630edc-a58c-4cbd-9b01-0e130455c8ae","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://www.asrmicro.com/en/goods/psirt?cid=45","source":"68630edc-a58c-4cbd-9b01-0e130455c8ae"}]}},{"cve":{"id":"CVE-2026-93368","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T09:17:09.247","lastModified":"2026-09-23T19:19:45.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress core applies wp_unslash() to the 'log' POST value before dispatching the wp_login_failed action, stripping magic-quotes backslash escaping and allowing a raw single quote to reach the plugin's handler unimpeded."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"travispluse","product":"Rename wp-login.php to anything you want","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:37:24.330305Z","id":"CVE-2026-93368","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L217","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L388","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L398","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L421","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a07c47-b57c-49de-9f7c-a2bb29e3fecc?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-95625","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T09:17:09.393","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Tauri","product":"tauri-plugin-updater","defaultStatus":"unaffected","collectionURL":"https://crates.io/crates/tauri-plugin-updater","packageName":"tauri-plugin-updater","programFiles":["plugins/updater/src/updater.rs","plugins/updater/src/config.rs"],"repo":"git://github.com/tauri-apps/plugins-workspace","versions":[{"version":"2.0.0","lessThan":"2.12.0","versionType":"semver","status":"affected"},{"version":"2.12.0","lessThanOrEqual":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:07:42.715205Z","id":"CVE-2026-95625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-354"}]}],"references":[{"url":"https://github.com/tauri-apps/plugins-workspace","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/plugins-workspace/commit/690dcfd694","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-j38x-g3m3-95fr","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-73192","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:07.660","lastModified":"2026-09-30T16:14:33.617","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.\n\nUpgrade to Apache Sling XSS >= 2.4.12"}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:05:46.959656Z","id":"CVE-2026-73192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://sling.apache.org/news.html","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/18","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-79616","sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","published":"2026-09-23T10:17:07.803","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path."}],"affected":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","affectedData":[{"vendor":"qt","product":"qt","defaultStatus":"unaffected","modules":["qtdeclarative"],"versions":[{"version":"5.10.0","lessThanOrEqual":"6.8.8","versionType":"python","status":"affected"},{"version":"6.9.0","lessThanOrEqual":"6.11.1","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","baseScore":0.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"USER","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"LOW","providerUrgency":"GREEN"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:23:55.405900Z","id":"CVE-2026-79616","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtdeclarative/+/754718","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}]}},{"cve":{"id":"CVE-2026-91852","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:07.960","lastModified":"2026-09-30T16:13:54.047","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:04:21.554097Z","id":"CVE-2026-91852","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"https://sling.apache.org/news.html","source":"security@apache.org","tags":["Product"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-91928","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.080","lastModified":"2026-09-30T16:12:41.497","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:02:16.525807Z","id":"CVE-2026-91928","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://lists.apache.org/thread/yfb1q6zob8mth5lr4jnsy3lhx9rfwb02","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-91999","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.200","lastModified":"2026-09-30T16:11:12.213","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:05:07.662459Z","id":"CVE-2026-91999","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://lists.apache.org/thread/xpcsdkr80ow9p13f7hp3ykrhzky9d4t4","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/14","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92001","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.323","lastModified":"2026-09-30T15:59:43.950","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:14:39.290915Z","id":"CVE-2026-92001","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-776"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://lists.apache.org/thread/m52jll26vc8g5jokbg0xt062o09wkghr","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/15","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-94243","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.440","lastModified":"2026-10-06T13:55:01.483","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.\n\n\n\nThis issue affects Apache Sling Security Bundle: before 1.3.2.\n\n\n\nUsers are recommended to upgrade to version 1.3.2, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling Security Bundle","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:16:29.466249Z","id":"CVE-2026-94243","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_security:*:*:*:*:*:*:*:*","versionEndExcluding":"1.3.2","matchCriteriaId":"ADE86A72-0C94-4189-9257-D2693EEBA930"}]}]}],"references":[{"url":"https://lists.apache.org/thread/ohz47f6hrflsjvt9m24qz69qm5w4bwyr","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/16","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-94251","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.557","lastModified":"2026-10-06T13:54:26.543","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource\n\n\n\nThis issue affects Apache Sling Security Bundle: before 1.3.12.\n\n\n\nUsers are recommended to upgrade to version 1.3.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling Security Bundle","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:20:37.552496Z","id":"CVE-2026-94251","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_security:*:*:*:*:*:*:*:*","versionEndExcluding":"1.3.2","matchCriteriaId":"ADE86A72-0C94-4189-9257-D2693EEBA930"}]}]}],"references":[{"url":"https://lists.apache.org/thread/7zo0drh75qmk1xn7940hy4pxjs6h2b10","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/17","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-95626","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T10:17:08.677","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Tauri","product":"tauri","defaultStatus":"unaffected","collectionURL":"https://crates.io/crates/tauri","packageName":"tauri","programFiles":["crates/tauri-utils/src/html.rs","crates/tauri/src/manager/mod.rs"],"repo":"git://github.com/tauri-apps/tauri","versions":[{"version":"2.0.0","lessThanOrEqual":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:03:10.553800Z","id":"CVE-2026-95626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/tauri-apps/tauri","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/tauri/security/advisories/GHSA-6vxm-x265-58qf","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-95627","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T10:17:08.810","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Tauri","product":"tauri-plugin-dialog","defaultStatus":"unaffected","collectionURL":"https://crates.io/crates/tauri-plugin-dialog","packageName":"tauri-plugin-dialog","programFiles":["plugins/dialog/src/commands.rs"],"repo":"git://github.com/tauri-apps/plugins-workspace","versions":[{"version":"2.0.0","lessThanOrEqual":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:21:31.658846Z","id":"CVE-2026-95627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://github.com/tauri-apps/plugins-workspace","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-vw89-89jm-wmqc","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-96443","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.943","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Doris","defaultStatus":"unaffected","versions":[{"version":"2.0.5","lessThanOrEqual":"4.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:14:14.842142Z","id":"CVE-2026-96443","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://lists.apache.org/thread/vv9o8sxpt8kkd7nznhovn9qjojn2wyv9","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/11","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-96454","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T10:17:09.070","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content.\n\n\n\nThe first is in src-tauri/capabilities/default.json, which grants IPC access with \"remote\": { \"urls\": [\"https://*.*\"] }. That wildcard tells Tauri to accept IPC from any HTTPS origin, not just the site the application was built to wrap. The second is \"withGlobalTauri\": true in src-tauri/tauri.conf.json, which puts window.__TAURI__.core.invoke() in reach of ordinary page JavaScript.\n\n\n\nTauri's access control list only checks plugin commands, the ones prefixed with plugin:. Commands the application registers itself through generate_handler!, known as app commands, are never checked against the ACL. So once an origin holds IPC access, it can call every app command with nothing else standing in the way. Pake registers download_file as an app command, and it does not appear in the permissions list because it does not need to.\n\n\n\nThe practical effect is that any script running on any HTTPS page inside a Pake application can invoke the application's native commands. That includes third-party script the wrapped site loads on its own, such as analytics, advertising, or a compromised CDN. Anyone distributing their own Pake application gets the same access without asking for it. Chained with the path traversal in download_file that is tracked separately as CVE-2026-82635, this reaches arbitrary file write and persistent code execution."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"tw93","product":"Pake","defaultStatus":"affected","collectionURL":"https://registry.npmjs.org","packageName":"pake-cli","platforms":["macOS","Windows","Linux"],"programFiles":["src-tauri/capabilities/default.json","src-tauri/tauri.conf.json"],"repo":"https://github.com/tw93/Pake","versions":[{"version":"0","lessThanOrEqual":"3.17.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:01:27.089525Z","id":"CVE-2026-96454","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-923"}]}],"references":[{"url":"https://github.com/tw93/Pake","source":"reefs@jfrog.com"},{"url":"https://github.com/tw93/Pake/blob/main/src-tauri/capabilities/default.json","source":"reefs@jfrog.com"},{"url":"https://github.com/tw93/Pake/blob/main/src-tauri/tauri.conf.json","source":"reefs@jfrog.com"},{"url":"https://github.com/tw93/Pake/releases/tag/V3.17.0","source":"reefs@jfrog.com"},{"url":"https://v2.tauri.app/security/capabilities/","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-5695","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-23T11:17:10.590","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Microweber","product":"Administration panel","defaultStatus":"unaffected","versions":[{"version":"2.0.19","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:46:21.222532Z","id":"CVE-2026-5695","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-5696","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-23T11:17:10.730","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Microweber","product":"Administration panel","defaultStatus":"unaffected","versions":[{"version":"2.0.19","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:09:23.700269Z","id":"CVE-2026-5696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-86601","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:13.970","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Recipe Maker","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"10.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:42.790665Z","id":"CVE-2026-86601","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://wpscan.com/vulnerability/be6b1fb1-222d-4563-8a19-41bed1960001/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86604","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:14.410","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"GTranslate","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"5.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:27.635210Z","id":"CVE-2026-86604","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://wpscan.com/vulnerability/07c6e3a2-e8fe-4b25-a5d8-b5ed812100af/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86612","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:14.730","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Ninja Tables","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"5.2.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:33.838232Z","id":"CVE-2026-86612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4be7a5e0-9657-4692-904d-b696224e32ec/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87070","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:15.333","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Forminator Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"1.57.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:03.336464Z","id":"CVE-2026-87070","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"references":[{"url":"https://wpscan.com/vulnerability/3206e88e-5d29-4897-863e-101dc9b33ec5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87071","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:15.463","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Forminator Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"1.57.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:34:54.159284Z","id":"CVE-2026-87071","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9d831b9d-c05d-4b9a-8b65-7e1e35e68510/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87848","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:15.750","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MPCX Lightbox","defaultStatus":"unknown","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"1.2.2","lessThanOrEqual":"1.2.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:34:47.454361Z","id":"CVE-2026-87848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/183ec34f-446f-481f-9019-26e005ad2cfb/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87978","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:15.880","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paymob for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"4.1.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:34:41.598724Z","id":"CVE-2026-87978","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7eecf65a-3b85-405e-bbe2-893960c82ba7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-90950","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:16.773","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paid Membership Subscriptions","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"2.0.5","lessThan":"3.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:34:34.838195Z","id":"CVE-2026-90950","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"references":[{"url":"https://wpscan.com/vulnerability/685f381e-97b5-4855-a0ca-5854043a7b9e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96442","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T11:17:18.550","lastModified":"2026-10-20T00:19:27.883","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"GNU Emacs","product":"GNU Emacs","defaultStatus":"unaffected","collectionURL":"https://git.savannah.gnu.org/cgit/emacs.git/","packageName":"emacs","versions":[{"version":"0","lessThan":"31.2","versionType":"semver","status":"affected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"1:29.4-14.el10_2.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"versions":[{"version":"1:27.2-18.el9_8.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/o:redhat:enterprise_linux:8"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:54:08.909184Z","id":"CVE-2026-96442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:84591","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:85245","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96442","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537347","source":"secalert@redhat.com"},{"url":"https://github.com/emacs-mirror/emacs/commit/135e6f63f08fee3d374fa1a5187bce941a2d3e3c","source":"secalert@redhat.com"},{"url":"https://github.com/emacs-mirror/emacs/commit/abc802ee2eb0b1663349ddf22a461f8e54a383fb","source":"secalert@redhat.com"},{"url":"https://www.openwall.com/lists/oss-security/2026/09/14/1","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96455","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T11:17:18.690","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just hands back the manager object from application state, so nothing in the chain ever checks a credential.\n\n\n\nThe endpoint takes an AppInfo body naming a Hugging Face Space. The daemon downloads that Space and installs it as a Python package through install_package in src/reachy_mini/apps/sources/local_common_venv.py, using uv or pip. Installing a Python package runs the package's own build and setup code, so whoever chooses the Space chooses what code the robot runs. Anyone can publish a public Hugging Face Space, so this is not a meaningful restriction on the attacker.\n\n\n\nHow far this reaches depends on the model. In _resolve_bind_host in src/reachy_mini/daemon/app/main.py the daemon binds 0.0.0.0 when it runs as the wireless version and 127.0.0.1 otherwise, with the vendor's own comment explaining that the robot has to be reachable on the LAN. On a wireless unit, then, any host on the same network can install and run code on the robot without credentials.\n\n\n\nOne related change has already shipped but does not fix this. Version 1.8.2 replaced the wildcard CORS policy with an allow list of localhost and Tauri origins. That closes the browser drive-by route, where a web page the victim visits silently calls the endpoint in the background. It has no effect on this issue: CORS is enforced by browsers and governs whether script may read a response, while a direct HTTP request from another machine on the network involves no browser, no preflight and no CORS check at all."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Pollen Robotics","product":"Reachy Mini","defaultStatus":"affected","collectionURL":"https://pypi.org","packageName":"reachy_mini","platforms":["Linux"],"programFiles":["src/reachy_mini/daemon/app/routers/apps.py","src/reachy_mini/daemon/app/main.py","src/reachy_mini/apps/sources/local_common_venv.py"],"programRoutines":[{"name":"install_app"},{"name":"install_package"},{"name":"_resolve_bind_host"}],"repo":"https://github.com/pollen-robotics/reachy_mini","versions":[{"version":"0","lessThanOrEqual":"1.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:59:27.912505Z","id":"CVE-2026-96455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-494"}]}],"references":[{"url":"https://github.com/pollen-robotics/reachy_mini","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/blob/main/src/reachy_mini/daemon/app/main.py","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/blob/main/src/reachy_mini/daemon/app/routers/apps.py","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/pull/1207","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/releases/tag/v1.11.0","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-96456","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T11:17:18.843","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication.\n\n\n\nThe authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler therefore has no idea which device sent a given write, and it cannot tell the authenticated one from any other.\n\n\n\nOnce any device completes the PIN exchange, the flag is set and every nearby device can send CMD_ commands until it resets. An attacker simply waits within radio range for a legitimate user to authenticate, then writes commands into the same window. No PIN is ever guessed or brute-forced.\n\n\n\nThis is the second step of a three-step chain that JFrog documented against the robot. The first is the unrestricted file upload in the media sounds API, tracked as CVE-2026-55419, which places an attacker-controlled script on the filesystem. This issue then provides command access over Bluetooth. The third is the Bluetooth command handler path traversal, tracked as CVE-2026-62661, which runs that script as root."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Pollen Robotics","product":"Reachy Mini","defaultStatus":"affected","collectionURL":"https://pypi.org","packageName":"reachy_mini","platforms":["Linux"],"programFiles":["src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py"],"programRoutines":[{"name":"WriteValue"}],"repo":"https://github.com/pollen-robotics/reachy_mini","versions":[{"version":"0","lessThanOrEqual":"1.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:56:00.359870Z","id":"CVE-2026-96456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://github.com/pollen-robotics/reachy_mini","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/blob/main/src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-993g-hgjh-whmf","source":"reefs@jfrog.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55419","source":"reefs@jfrog.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62661","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-12370","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:05.373","lastModified":"2026-09-24T14:17:11.450","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.668","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine NetFlow Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.668","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Network Configuration Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.668","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T03:55:27.041850Z","id":"CVE-2026-12370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-12370.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-14913","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:05.507","lastModified":"2026-09-24T04:17:39.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.670","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.670","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-14913","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-14913.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-15358","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:05.630","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.671","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Network Configuration Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.671","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:34:27.546462Z","id":"CVE-2026-15358","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-428"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-15358.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-73581","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.287","lastModified":"2026-09-30T15:22:34.000","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThan":"8.5.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:19:35.322766Z","id":"CVE-2026-73581","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-299"}]}],"references":[{"url":"https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/19","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-75973","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.410","lastModified":"2026-09-23T19:19:14.230","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M4","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:28:51.510257Z","id":"CVE-2026-75973","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/20","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-76183","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.537","lastModified":"2026-09-30T15:22:34.470","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOS at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"7.0.43","lessThanOrEqual":"7.0.109","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.0.43","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:33:34.949308Z","id":"CVE-2026-76183","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-289"}]}],"references":[{"url":"https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/21","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-77756","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.663","lastModified":"2026-09-23T19:19:18.720","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.47","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.67","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:18:16.430403Z","id":"CVE-2026-77756","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj2794vhor7o6xl3z","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/22","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-77762","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.800","lastModified":"2026-09-30T15:22:35.070","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.39","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.59","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:40:01.556894Z","id":"CVE-2026-77762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://lists.apache.org/thread/y5r9fvjo7ol24mkoyoc0st8bqrfyqcyn","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/23","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-77791","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.927","lastModified":"2026-09-23T19:19:19.043","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M5","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.8","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.74","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.88","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:44:33.453302Z","id":"CVE-2026-77791","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lqwlon4cz","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/24","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-78253","sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","published":"2026-09-23T12:17:07.063","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document."}],"affected":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","affectedData":[{"vendor":"qt","product":"qt","defaultStatus":"unaffected","modules":["qtbase"],"versions":[{"version":"5.0.0","lessThanOrEqual":"6.8.8","versionType":"python","status":"affected"},{"version":"6.9.0","lessThanOrEqual":"6.11.1","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:Green","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"NO","Recovery":"USER","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"LOW","providerUrgency":"GREEN"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:35:55.687793Z","id":"CVE-2026-78253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/754345","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}]}},{"cve":{"id":"CVE-2026-78383","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:07.213","lastModified":"2026-09-23T19:19:21.470","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:44:38.108504Z","id":"CVE-2026-78383","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/25","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-78437","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:07.340","lastModified":"2026-09-23T19:19:21.640","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.19","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.53","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.116","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:25:38.365317Z","id":"CVE-2026-78437","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"references":[{"url":"https://lists.apache.org/thread/qkmsos3s8chn5053qr466rzwv6sk5gjg","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/26","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-79677","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:07.593","lastModified":"2026-09-23T19:19:28.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"7.0.43","lessThanOrEqual":"7.0.109","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.0.43","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:05:21.474452Z","id":"CVE-2026-79677","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-772"},{"lang":"en","value":"CWE-1025"}]}],"references":[{"url":"https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/27","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-80444","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-23T12:17:07.723","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation.\n\nThis issue affects AVESİS: from 202608201331 before 202608240351."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Abis Technology Ltd. Co.","product":"AVESİS","defaultStatus":"unaffected","versions":[{"version":"202608201331","lessThan":"202608240351","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:37:28.642604Z","id":"CVE-2026-80444","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1159","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-84787","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:07.857","lastModified":"2026-09-24T04:18:02.883","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-84787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-84787.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-84789","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:07.983","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:42:46.343667Z","id":"CVE-2026-84789","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-84789.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-84791","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:08.110","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:42:10.958434Z","id":"CVE-2026-84791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-84791.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86248","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:08.237","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M14","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.22","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.92","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:14:53.442167Z","id":"CVE-2026-86248","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-86350","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:08.350","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.22","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.55","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.118","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:16:46.410403Z","id":"CVE-2026-86350","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-87022","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:08.640","lastModified":"2026-09-23T19:19:42.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"7.0.56","lessThanOrEqual":"7.0.109","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:27:17.688403Z","id":"CVE-2026-87022","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-130"}]}],"references":[{"url":"https://lists.apache.org/thread/ypvlkjqsq0480fnk9jm6h9qllddwlw4w","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/30","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-96445","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T12:17:08.773","lastModified":"2026-09-24T14:51:56.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:18:59.386636Z","id":"CVE-2026-96445","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96445","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539280","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96446","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T12:17:08.913","lastModified":"2026-09-26T23:16:40.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:45:14.542570Z","id":"CVE-2026-96446","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96446","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539284","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-19599","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:27.400","lastModified":"2026-09-24T04:17:48.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-19599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-19599.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-75825","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:28.557","lastModified":"2026-09-24T04:17:55.500","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-75825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-75825.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-76978","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:29.153","lastModified":"2026-09-24T04:17:59.137","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]},{"vendor":"ZohoCorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-76978","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-76978.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-76979","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:29.273","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]},{"vendor":"ZohoCorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:01:09.425453Z","id":"CVE-2026-76979","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-91"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-76979.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-76980","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:29.393","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:38:35.264539Z","id":"CVE-2026-76980","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-76980.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-77112","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-23T13:17:29.680","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery.\n\nThis issue affects Weoll: before 3.2.45.44."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Global IT Informatics Technology Services Inc.","product":"Weoll","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.2.45.44","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:39:22.621078Z","id":"CVE-2026-77112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1160","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-84091","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T13:17:30.623","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"SUMIT Payment Gateway for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"4.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:35:44.939195Z","id":"CVE-2026-84091","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/10c7a9bd-eac0-49eb-9238-d7c477312166/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86243","sourceIdentifier":"security@apache.org","published":"2026-09-23T13:17:30.993","lastModified":"2026-10-06T13:53:46.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThanOrEqual":"2.0.15","versionType":"semver","status":"affected"},{"version":"1.3.0","lessThanOrEqual":"1.3.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:28:53.132953Z","id":"CVE-2026-86243","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-126"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"1.3.9","matchCriteriaId":"F73CA9D6-BD48-4223-B2AC-6F345E0895C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.16","matchCriteriaId":"AC3D1E2E-A1EE-4F33-8D7F-11D37A8AAE66"}]}]}],"references":[{"url":"https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/31","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-86246","sourceIdentifier":"security@apache.org","published":"2026-09-23T13:17:31.117","lastModified":"2026-10-06T13:50:57.873","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default  including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThanOrEqual":"2.0.15","versionType":"semver","status":"affected"},{"version":"1.3.0","lessThanOrEqual":"1.3.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:29:46.583140Z","id":"CVE-2026-86246","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"1.3.9","matchCriteriaId":"F73CA9D6-BD48-4223-B2AC-6F345E0895C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.16","matchCriteriaId":"AC3D1E2E-A1EE-4F33-8D7F-11D37A8AAE66"}]}]}],"references":[{"url":"https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/32","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-86247","sourceIdentifier":"security@apache.org","published":"2026-09-23T13:17:31.237","lastModified":"2026-10-06T13:46:49.633","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThanOrEqual":"2.0.15","versionType":"semver","status":"affected"},{"version":"1.3.0","lessThanOrEqual":"1.3.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:30:32.467469Z","id":"CVE-2026-86247","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-366"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"1.3.9","matchCriteriaId":"F73CA9D6-BD48-4223-B2AC-6F345E0895C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.16","matchCriteriaId":"AC3D1E2E-A1EE-4F33-8D7F-11D37A8AAE66"}]}]}],"references":[{"url":"https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/33","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-95676","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-23T13:17:32.143","lastModified":"2026-10-07T15:30:58.957","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"AuthPoint Authentication Gateway","defaultStatus":"unaffected","versions":[{"version":"4.2.2","lessThan":"7.5.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:24:44.392517Z","id":"CVE-2026-95676","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-636"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:watchguard:authentication_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.2","versionEndExcluding":"7.5.1","matchCriteriaId":"4B2BE157-2746-499C-B7A9-0D37A842871A"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-95676","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-12974","sourceIdentifier":"psirt@forcepoint.com","published":"2026-09-23T14:17:06.547","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).\n\n\nThis issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0."}],"affected":[{"source":"psirt@forcepoint.com","affectedData":[{"vendor":"Forcepoint","product":"Forcepoint Security Engine (NGFW)","defaultStatus":"unaffected","versions":[{"version":"7.1.0","lessThanOrEqual":"7.1.13","versionType":"semver","status":"affected"},{"version":"7.3.0","lessThanOrEqual":"7.3.1","versionType":"semver","status":"affected"},{"version":"7.3.3","versionType":"semver","status":"affected"},{"version":"7.4.0","lessThanOrEqual":"7.4.1","versionType":"semver","status":"affected"},{"version":"7.5.0","versionType":"custom","status":"affected"},{"version":"7.3.2","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@forcepoint.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"ATTACKED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:23:42.713648Z","id":"CVE-2026-12974","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@forcepoint.com","type":"Secondary","description":[{"lang":"en","value":"CWE-183"},{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://support.forcepoint.com/s/article/Security-Advisory-Security-Policy-Bypass-in-Forcepoint-Security-Engine-NGFW-CVE-2026-12974","source":"psirt@forcepoint.com"}]}},{"cve":{"id":"CVE-2026-18177","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T14:17:07.660","lastModified":"2026-10-07T13:03:55.270","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:18:37.954474Z","id":"CVE-2026-18177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18179","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T14:17:07.783","lastModified":"2026-10-07T13:03:53.020","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:17:01.741086Z","id":"CVE-2026-18179","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-59167","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T14:17:07.923","lastModified":"2026-09-24T15:17:25.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"JiHong88","product":"suneditor","versions":[{"version":"< 2.47.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:24:21.114425Z","id":"CVE-2026-59167","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045","source":"security-advisories@github.com"},{"url":"https://github.com/JiHong88/suneditor/issues/1646","source":"security-advisories@github.com"},{"url":"https://github.com/JiHong88/suneditor/releases/tag/2.47.11","source":"security-advisories@github.com"},{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4","source":"security-advisories@github.com"},{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-86677","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:08.803","lastModified":"2026-09-24T04:18:03.010","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182100","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-86677","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86677.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86678","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:08.963","lastModified":"2026-09-24T04:18:03.127","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182100","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-86678","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86678.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86679","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:09.090","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182100","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:40:04.396312Z","id":"CVE-2026-86679","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86679.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86681","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:09.217","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182300","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:24:19.923123Z","id":"CVE-2026-86681","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86681.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86683","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:09.347","lastModified":"2026-09-24T04:18:03.250","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182100","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-86683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86683.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86708","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:09.467","lastModified":"2026-09-24T04:18:03.367","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182300","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-86708","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86708.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-96512","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T14:17:10.747","lastModified":"2026-10-22T06:17:15.710","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:1.9.17-10.p2.el10_2.7","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"versions":[{"version":"0:1.9.15-8.p5.el10_0.5","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"versions":[{"version":"0:1.9.5p2-2.el8_10","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"versions":[{"version":"0:1.9.5p2-1.el8_8.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"versions":[{"version":"0:1.9.5p2-1.el8_8.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"versions":[{"version":"0:1.9.17p2-3.el9_8.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"versions":[{"version":"0:1.9.17p2-3.el9_8.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream","cpe:/o:redhat:rhel_e4s:9.4::baseos"],"versions":[{"version":"0:1.9.5p2-10.el9_4.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream","cpe:/o:redhat:rhel_eus:9.6::baseos"],"versions":[{"version":"0:1.9.5p2-10.el9_6.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"sudo-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"1.9.17-16.p2.2.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"rhui5/installer-rhel9","cpes":["cpe:/a:redhat:rhui:5::el9"],"versions":[{"version":"1791964013","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"rhui5/rhua-rhel9","cpes":["cpe:/a:redhat:rhui:5::el9"],"versions":[{"version":"1791978693","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:enterprise_linux:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-96512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71609","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75571","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75579","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75580","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82939","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86633","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86634","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86635","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:87026","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96512","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539327","source":"secalert@redhat.com"},{"url":"https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/4","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-96559","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-23T14:17:10.900","lastModified":"2026-09-23T14:17:10.900","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This ID was for testing"}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-96560","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T14:17:11.073","lastModified":"2026-09-23T17:17:49.440","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ModelTC","product":"LightLLM","defaultStatus":"unaffected","packageName":"LightLLM","repo":"https://github.com/ModelTC/lightllm","packageURL":"pkg:github/ModelTC/lightllm","versions":[{"version":"0","lessThanOrEqual":"1.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:30:06.350499Z","id":"CVE-2026-96560","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/ModelTC/LightLLM/issues/1590","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/kv_transporter.py#L20-L36","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L247-L249","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L411-L415","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L437-L461","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-nccl-pd-rpyc-control-channel","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-55610","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:14.580","lastModified":"2026-09-23T20:17:11.580","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company — it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoiceShelf","product":"InvoiceShelf","versions":[{"version":"< 2.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:14:01.010220Z","id":"CVE-2026-55610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-vgx6-6cqr-m8qr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61413","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:14.867","lastModified":"2026-09-25T13:36:02.150","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-61413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-61834","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.127","lastModified":"2026-09-23T17:17:15.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such as toString can therefore traverse into a shared built-in function object and add attacker-controlled properties, causing process-global mutation that may affect application logic reading inherited-method properties. This issue is fixed in version 0.9.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thomaspoignant","product":"scim-patch","versions":[{"version":"< 0.9.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:20:07.829094Z","id":"CVE-2026-61834","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-915"},{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/thomaspoignant/scim-patch/commit/c86474f7a9b16191d939f59ba94eca6c6e63044b","source":"security-advisories@github.com"},{"url":"https://github.com/thomaspoignant/scim-patch/pull/1127","source":"security-advisories@github.com"},{"url":"https://github.com/thomaspoignant/scim-patch/releases/tag/v0.9.2","source":"security-advisories@github.com"},{"url":"https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-2mhw-wcx5-v3xj","source":"security-advisories@github.com"},{"url":"https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-2mhw-wcx5-v3xj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-62998","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.293","lastModified":"2026-10-19T19:37:26.643","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"redaxo","product":"core","versions":[{"version":"< 5.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:22:29.404424Z","id":"CVE-2026-62998","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21.2","matchCriteriaId":"AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E"}]}]}],"references":[{"url":"https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/redaxo/core/pull/6580","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63000","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.453","lastModified":"2026-10-19T20:35:09.623","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"redaxo","product":"core","versions":[{"version":"< 5.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T01:56:03.005133Z","id":"CVE-2026-63000","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21.2","matchCriteriaId":"AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E"}]}]}],"references":[{"url":"https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/redaxo/core/pull/6579","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63001","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.617","lastModified":"2026-10-19T20:35:19.627","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"redaxo","product":"core","versions":[{"version":"< 5.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:17:12.653764Z","id":"CVE-2026-63001","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21.2","matchCriteriaId":"AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E"}]}]}],"references":[{"url":"https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/redaxo/core/pull/6581","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63002","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.770","lastModified":"2026-10-19T20:36:13.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"redaxo","product":"core","versions":[{"version":"< 5.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:26:05.685430Z","id":"CVE-2026-63002","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21.2","matchCriteriaId":"AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E"}]}]}],"references":[{"url":"https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/redaxo/core/pull/6581","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-71177","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:16.457","lastModified":"2026-09-25T13:35:54.867","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session theft."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:22:57.501182Z","id":"CVE-2026-71177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1021"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-71178","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:16.590","lastModified":"2026-09-26T23:16:34.830","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:38:49.901728Z","id":"CVE-2026-71178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-647"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73586","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:17.583","lastModified":"2026-09-25T13:35:41.337","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":0.9,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-73586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73587","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:17.720","lastModified":"2026-09-25T13:35:34.083","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-73587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73588","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:17.850","lastModified":"2026-09-25T13:35:26.967","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-73588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73589","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:17.973","lastModified":"2026-09-25T13:35:20.753","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T03:55:35.304424Z","id":"CVE-2026-73589","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-261"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73591","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:18.103","lastModified":"2026-09-25T13:35:10.853","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:15:42.563093Z","id":"CVE-2026-73591","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-540"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73858","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:18.233","lastModified":"2026-09-23T18:12:04.247","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in submitted field values, including value attributes, and receive evaluated PHP, operating-system, or Craft filesystem-path constants in the form response. The isolated context was not shown to expose Craft globals, environment variables, credentials, arbitrary files, or code execution, so the confirmed impact is limited server and environment information disclosure and possible rendering errors. This issue is fixed in version 5.10.14."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"solspace","product":"craft-freeform","versions":[{"version":">= 5.0.0, < 5.10.14","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:20:33.646811Z","id":"CVE-2026-73858","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/solspace/craft-freeform/commit/5f7555320635f1cd3b4c478aa0b58e8c3144313b","source":"security-advisories@github.com"},{"url":"https://github.com/solspace/craft-freeform/pull/1986","source":"security-advisories@github.com"},{"url":"https://github.com/solspace/craft-freeform/releases/tag/v5.10.14","source":"security-advisories@github.com"},{"url":"https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w","source":"security-advisories@github.com"},{"url":"https://github.com/solspace/craft-freeform/security/advisories/GHSA-gxrg-x694-283w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88974","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:23.893","lastModified":"2026-09-23T18:12:04.247","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"WPGraphQL provides a GraphQL API for WordPress sites. Prior to 2.22.2, the updatePost mutation in src/Mutation/PostObjectUpdate.php checks only the collection-level edit_posts capability and the post author, but does not enforce the object-level edit_post capability or require publish_posts for public status transitions. An authenticated Contributor can therefore publish the Contributor's own draft without editorial approval or modify the Contributor's previously published post despite lacking edit_published_posts, while posts owned by other authors remain protected. This issue is fixed in version 2.22.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"wp-graphql","product":"wp-graphql","versions":[{"version":"< 2.22.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:21:07.871440Z","id":"CVE-2026-88974","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/wp-graphql/wp-graphql/commit/55441663eaa33c3f2e05de038c8286c845916461","source":"security-advisories@github.com"},{"url":"https://github.com/wp-graphql/wp-graphql/pull/4270","source":"security-advisories@github.com"},{"url":"https://github.com/wp-graphql/wp-graphql/releases/tag/wp-graphql%2Fv2.22.2","source":"security-advisories@github.com"},{"url":"https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wggg","source":"security-advisories@github.com"},{"url":"https://github.com/wp-graphql/wp-graphql/security/advisories/GHSA-5mmc-8pc9-wggg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92164","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:29.257","lastModified":"2026-09-29T02:16:55.673","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"streamlink","product":"streamlink","versions":[{"version":"< 8.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T01:57:07.991376Z","id":"CVE-2026-92164","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"references":[{"url":"https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6","source":"security-advisories@github.com"},{"url":"https://github.com/streamlink/streamlink/releases/tag/8.6.0","source":"security-advisories@github.com"},{"url":"https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v","source":"security-advisories@github.com"},{"url":"https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92419","sourceIdentifier":"cvd@cert.pl","published":"2026-09-23T15:17:29.543","lastModified":"2026-09-23T16:16:47.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply arbitrary user logins in the selectedPeople parameter to view vacation schedules of other employees, including managers and staff from other offices, regardless of business logic access restrictions, resulting in unauthorized disclosure of sensitive scheduling information.This vulnerability was fixed in versions: 2025.2.1.177 and 2026.1.1.20"}],"affected":[{"source":"cvd@cert.pl","affectedData":[{"vendor":"WEBCON","product":"WEBCON BPS","defaultStatus":"unaffected","versions":[{"version":"2024.1.1.145","lessThan":"2025.2.1.177","versionType":"custom","status":"affected"},{"version":"2026.1.1.1","lessThan":"2026.1.1.20","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cvd@cert.pl","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:20:04.450494Z","id":"CVE-2026-92419","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cvd@cert.pl","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://cert.pl/en/posts/2026/09/CVE-2026-92419","source":"cvd@cert.pl"}]}},{"cve":{"id":"CVE-2026-96275","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T15:17:32.180","lastModified":"2026-10-12T17:17:38.987","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:1.16.0-9.el10_2.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream","cpe:/a:redhat:enterprise_linux:8::crb"],"versions":[{"version":"0:1.12.9-7.el8_10","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb"],"versions":[{"version":"0:1.12.9-4.el9_8.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","cpes":["cpe:/o:redhat:enterprise_linux:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:09:09.886853Z","id":"CVE-2026-96275","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:80497","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:80498","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:80687","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96275","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539416","source":"secalert@redhat.com"},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-fqx6-vh4p-42cg","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96276","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T15:17:32.317","lastModified":"2026-09-27T21:17:03.160","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"flatpak","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:28:10.393280Z","id":"CVE-2026-96276","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96276","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539418","source":"secalert@redhat.com"},{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96599","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T15:17:33.237","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"isotope","product":"isotope-core","defaultStatus":"unaffected","packageURL":"pkg:composer/isotope/isotope-core","versions":[{"version":"0","lessThanOrEqual":"2.9.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:19:36.657196Z","id":"CVE-2026-96599","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-330"}]}],"references":[{"url":"https://github.com/isotope/core","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Model/ProductCollection/Order.php#L612-L618","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Module/OrderDetails.php#L82-L104","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/issues/2585","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-weak-order-identifier-generation","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/issues/2585","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96600","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T15:17:33.400","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit conditional and time-based injection payloads to extract arbitrary database contents including user password hashes from the tl_user table."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"isotope","product":"isotope-core","defaultStatus":"unaffected","packageURL":"pkg:composer/isotope/isotope-core","versions":[{"version":"0","lessThanOrEqual":"2.9.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:03:20.750465Z","id":"CVE-2026-96600","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/isotope/core","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L186-L188","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/Attribute/Callback.php#L38","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Backend/ProductPrice/Callback.php#L155-L200","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/blob/028d47cbe69c7712339d34539721bea7369dc937/system/modules/isotope/library/Isotope/Widget/MediaManager.php#L468","source":"disclosure@vulncheck.com"},{"url":"https://github.com/isotope/core/issues/2585","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/isotope-ecommerce-through-2.9.10-sql-injection-via-backend-callbacks","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96609","sourceIdentifier":"cve@mitre.org","published":"2026-09-23T15:17:33.723","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognized termination condition. This is only exploitable by users who can send console subscription commands to unikernels that produce sufficient log output to fill the ring buffer (1024 lines). It is not exploitable by unauthorized clients."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Robur","product":"Albatross","defaultStatus":"unaffected","repo":"https://github.com/robur-coop/albatross","packageURL":"pkg:opam/albatross","versions":[{"version":"1.0.0","lessThan":"2.7.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:21:49.993447Z","id":"CVE-2026-96609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/robur-coop/albatross/pull/273","source":"cve@mitre.org"},{"url":"https://osv.dev/vulnerability/OSEC-2026-09","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-96611","sourceIdentifier":"cve@mitre.org","published":"2026-09-23T15:17:34.160","lastModified":"2026-10-15T19:43:29.817","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing values exceeding INT_MAX to become negative. In read_image_grid(), accumulating these values causes signed integer overflow (undefined behavior per C17 section 6.5), which on x86 wraps to a small positive value, bypassing downstream validity checks."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"FFmpeg","product":"FFmpeg","defaultStatus":"unaffected","modules":["libavformat"],"programFiles":["libavformat/mov.c"],"repo":"https://github.com/FFmpeg/FFmpeg","versions":[{"version":"0","lessThan":"9.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.4,"impactScore":5.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:45:28.706458Z","id":"CVE-2026-96611","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:*","versionEndExcluding":"9.0","matchCriteriaId":"56F7746F-23B0-488C-A9F7-FB8BDDBA990A"}]}]}],"references":[{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/059eb2e853c1f62b8df1b73be9318061a7a21b0b","source":"cve@mitre.org","tags":["Patch"]},{"url":"https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23455","source":"cve@mitre.org","tags":["Issue Tracking","Patch"]}]}},{"cve":{"id":"CVE-2026-18180","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:40.957","lastModified":"2026-10-07T13:03:50.630","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.0.8.04.0.9.04.0.10.0 Interim Fix 064","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:43:50.314916Z","id":"CVE-2026-18180","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18181","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:41.083","lastModified":"2026-10-07T13:03:47.883","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:45:18.002483Z","id":"CVE-2026-18181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18184","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:41.210","lastModified":"2026-10-07T13:03:45.330","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:48:59.120752Z","id":"CVE-2026-18184","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18185","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:41.337","lastModified":"2026-10-07T13:03:42.913","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:28:09.195903Z","id":"CVE-2026-18185","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18490","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:41.460","lastModified":"2026-10-07T13:03:40.013","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:13:02.634803Z","id":"CVE-2026-18490","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18505","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:41.590","lastModified":"2026-10-07T13:03:16.430","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to open redirect in the PMP `HostHeaderFilter` (`HostHeaderFilter.java:151`). An unauthenticated attacker can craft a request with a manipulated `Host` header to redirect authenticated operators to attacker-controlled sites, enabling credential phishing."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:45:51.817996Z","id":"CVE-2026-18505","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18872","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:41.720","lastModified":"2026-10-07T13:03:10.417","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:45:05.990697Z","id":"CVE-2026-18872","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18875","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:41.850","lastModified":"2026-10-07T13:03:07.517","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:48:17.834051Z","id":"CVE-2026-18875","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-19087","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:41.980","lastModified":"2026-10-07T13:03:04.797","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper privilege management."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:31:30.446340Z","id":"CVE-2026-19087","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-250"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-19179","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:42.107","lastModified":"2026-10-07T13:03:01.670","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:11:47.364009Z","id":"CVE-2026-19179","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-19267","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:42.237","lastModified":"2026-10-07T13:02:57.947","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint (`CommandsResource.java:31`). A local actor can invoke unauthenticated commands to cause resource exhaustionand halt business-rule management functions."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:47:23.416002Z","id":"CVE-2026-19267","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-3626","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:43.157","lastModified":"2026-09-28T18:52:21.293","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:44:48.542483Z","id":"CVE-2026-3626","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-209"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-4921","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:43.687","lastModified":"2026-10-20T15:37:10.197","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Guardium Data Protection","cpes":["cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:guardium_data_protection:12.2.0:*:*:*:*:*:*:*"],"versions":[{"version":"12.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:48:07.913371Z","id":"CVE-2026-4921","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-209"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:guardium_data_protection:12.2:*:*:*:*:*:*:*","matchCriteriaId":"CBA75153-5681-40C8-8EB4-236EF2EC8A4B"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288827","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-6327","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T16:16:43.947","lastModified":"2026-09-28T18:53:06.570","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:33:06.136763Z","id":"CVE-2026-6327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-117"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-79304","sourceIdentifier":"cve@mitre.org","published":"2026-09-23T16:16:45.347","lastModified":"2026-09-24T21:18:44.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain's home directory, the application returns the contents of files readable by the CyberPanel execution identity."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T20:12:33.159895Z","id":"CVE-2026-79304","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79304.md","source":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/blob/v1.9.1/CyberCP/secMiddleware.py#L67-L70","source":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/filemanager.py#L20-L27","source":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/filemanager.py#L267-L276","source":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/views.py#L98-L135","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-79306","sourceIdentifier":"cve@mitre.org","published":"2026-09-23T16:16:45.523","lastModified":"2026-09-25T15:17:55.590","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property, together with attacker-controlled basePath and compressedFileName values, in a method=compress request. Because the application validates only domain ownership and does not canonicalize or restrict these paths to the authorized site directory, the backend appends them to zip or tar archive commands and executes them as the website externalApp user, allowing disclosure of arbitrary readable files through the generated archive."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:24:04.305577Z","id":"CVE-2026-79306","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79306.md","source":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/blob/v1.9.1/CyberCP/secMiddleware.py#L70-L71","source":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/filemanager.py#L23-L27","source":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/filemanager.py#L378-L406","source":"cve@mitre.org"},{"url":"https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/views.py#L101-L143","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-79310","sourceIdentifier":"cve@mitre.org","published":"2026-09-23T16:16:45.687","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to and later renders them through the precompiled template loader, the sandbox is bypassed and the attacker's code runs, resulting in arbitrary Python code execution and OS command execution on the server."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:21:09.713651Z","id":"CVE-2026-79310","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79310.md","source":"cve@mitre.org"},{"url":"https://github.com/webpy/webpy","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-93769","sourceIdentifier":"help@fluidattacks.com","published":"2026-09-23T16:16:48.360","lastModified":"2026-09-23T17:17:20.143","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title."}],"affected":[{"source":"help@fluidattacks.com","affectedData":[{"vendor":"Humhub","product":"Humhub","defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"versions":[{"version":"1.18.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"help@fluidattacks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:35:11.904601Z","id":"CVE-2026-93769","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"help@fluidattacks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://fluidattacks.com/advisories/cali","source":"help@fluidattacks.com"},{"url":"https://github.com/humhub/humhub","source":"help@fluidattacks.com"},{"url":"https://github.com/humhub/humhub/pull/8499","source":"help@fluidattacks.com"}]}},{"cve":{"id":"CVE-2026-96672","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T16:16:49.993","lastModified":"2026-09-29T02:16:56.117","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Frappe","product":"ERPNext","defaultStatus":"unaffected","repo":"https://github.com/frappe/erpnext","packageURL":"pkg:github/frappe/erpnext","versions":[{"version":"16.0.0","lessThan":"16.34.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T01:59:00.905122Z","id":"CVE-2026-96672","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-470"}]}],"references":[{"url":"https://github.com/frappe/erpnext","source":"disclosure@vulncheck.com"},{"url":"https://github.com/frappe/erpnext/blob/v16.34.0/erpnext/accounts/doctype/financial_report_template/financial_report_engine.py#L1166-L1171","source":"disclosure@vulncheck.com"},{"url":"https://github.com/frappe/erpnext/blob/v16.34.0/erpnext/accounts/doctype/financial_report_template/financial_report_template.json","source":"disclosure@vulncheck.com"},{"url":"https://github.com/frappe/erpnext/commit/7aad59b129711e9bba17b25665428d1fc57bf37c","source":"disclosure@vulncheck.com"},{"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-794x-fhm7-58j7","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/frappe-erpnext-before-16.34.1-unauthorized-method-invocation","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96673","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T16:16:50.183","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the album_id path segment. Attackers can supply crafted SQL expressions in the album_id parameter to extract arbitrary data from the database using time-based or blind injection techniques."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Photoview","product":"Photoview","defaultStatus":"unaffected","repo":"https://github.com/photoview/photoview","packageURL":"pkg:github/photoview/photoview","versions":[{"version":"0","lessThanOrEqual":"2.4.0","versionType":"custom","status":"affected"},{"version":"deb1b216e047a30803dc0f48a9fc3d4c4abda594","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:27:19.576482Z","id":"CVE-2026-96673","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/photoview/photoview","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/blob/v2.4.0/api/routes/downloads.go#L19-L29","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/commit/deb1b216e047a30803dc0f48a9fc3d4c4abda594","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/pull/1453","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/sqli-in-download-photoview","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/photoview-through-2.4.0-sql-injection-via-album-download-route","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/sqli-in-download-photoview","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96674","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T16:16:50.350","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer and potentially leak sensitive data or crash the application."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ALSA Project","product":"alsa-lib","defaultStatus":"unaffected","repo":"https://github.com/alsa-project/alsa-lib","packageURL":"pkg:github/alsa-project/alsa-lib","versions":[{"version":"0","lessThanOrEqual":"1.2.16.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:13:27.889547Z","id":"CVE-2026-96674","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/alsa-project/alsa-lib","source":"disclosure@vulncheck.com"},{"url":"https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1316-L1326","source":"disclosure@vulncheck.com"},{"url":"https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1420-L1430","source":"disclosure@vulncheck.com"},{"url":"https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/topology/ctl.c#L1511-L1521","source":"disclosure@vulncheck.com"},{"url":"https://github.com/alsa-project/alsa-lib/pull/527","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-integer-overflow-via-topology-file","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96675","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T16:16:50.523","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failure, causing the application to abort."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ALSA Project","product":"alsa-lib","defaultStatus":"unaffected","repo":"https://github.com/alsa-project/alsa-lib","packageURL":"pkg:github/alsa-project/alsa-lib","versions":[{"version":"0","lessThanOrEqual":"1.2.16.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:43:25.304056Z","id":"CVE-2026-96675","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/alsa-project/alsa-lib","source":"disclosure@vulncheck.com"},{"url":"https://github.com/alsa-project/alsa-lib/blob/v1.2.16.1/src/pcm/pcm_multi.c#L1122-L1131","source":"disclosure@vulncheck.com"},{"url":"https://github.com/alsa-project/alsa-lib/pull/527","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/alsa-lib-through-1.2.16.1-denial-of-service-via-pcm-multi","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2025-63564","sourceIdentifier":"cve@mitre.org","published":"2026-09-23T17:17:14.323","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests"},{"lang":"es","value":"Vulnerabilidad de inyección SQL en el plugin Moodle Socialwall v.3.0 hasta v.3.3 permite a un atacante ejecutar código arbitrario mediante solicitudes HTTP manipuladas."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:30:43.427357Z","id":"CVE-2025-63564","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"http://moodle.com","source":"cve@mitre.org"},{"url":"https://medium.com/@lcrawfqrd/sqli-in-moodle-plugin-9f0ce4eb05f2","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-19888","sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","published":"2026-09-23T17:17:14.917","lastModified":"2026-09-23T19:40:10.000","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection."}],"affected":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","affectedData":[{"vendor":"n/a","product":"PgBouncer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:33:38.167752Z","id":"CVE-2026-19888","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://www.pgbouncer.org/changelog.html","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}},{"cve":{"id":"CVE-2026-6668","sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","published":"2026-09-23T17:17:16.073","lastModified":"2026-09-23T19:40:10.000","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow."}],"affected":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","affectedData":[{"vendor":"n/a","product":"PgBouncer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:33:22.320321Z","id":"CVE-2026-6668","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","description":[{"lang":"en","value":"CWE-190"},{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://www.pgbouncer.org/changelog.html","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}},{"cve":{"id":"CVE-2026-6669","sourceIdentifier":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","published":"2026-09-23T17:17:16.223","lastModified":"2026-09-23T19:40:10.000","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained."}],"affected":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","affectedData":[{"vendor":"n/a","product":"PgBouncer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.25.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:33:29.069636Z","id":"CVE-2026-6669","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://www.pgbouncer.org/changelog.html","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}]}},{"cve":{"id":"CVE-2026-85724","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T17:17:17.623","lastModified":"2026-09-25T13:34:57.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"moquette-io","product":"moquette","versions":[{"version":"< 0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:18:56.863679Z","id":"CVE-2026-85724","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-155"},{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","versionEndExcluding":"0.18.1","matchCriteriaId":"3C13C0A2-7D78-4742-8861-54D487319A82"}]}]}],"references":[{"url":"https://github.com/moquette-io/moquette/commit/b4a98bb3f3425ece476ed073aa080c627c1239af","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-88830","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T17:17:18.427","lastModified":"2026-09-23T20:17:20.750","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","cpes":["cpe:/a:redhat:hummingbird:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:36:12.931893Z","id":"CVE-2026-88830","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-131"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-88830","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531344","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-88832","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T17:17:18.573","lastModified":"2026-09-25T23:16:54.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow when processing crafted filesystem images."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"busybox-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"1.37.0-9.1.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-88832","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:72111","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-88832","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531345","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-93349","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T17:17:19.653","lastModified":"2026-09-28T15:17:24.560","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters in resource path values within a datapackage.json descriptor, which are passed unsanitized to os.system through a shell, causing arbitrary command execution in the victim's security context when they run the explore command against the untrusted package. This vulnerability was also addressed in version 5.20.0rc2 of the pre-release branch."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"frictionlessdata","product":"frictionless-py","defaultStatus":"unaffected","repo":"https://github.com/frictionlessdata/frictionless-py","packageURL":"pkg:github/frictionlessdata/frictionless-py","versions":[{"version":"0","lessThan":"5.19.1","versionType":"semver","status":"affected"},{"version":"5.20.0rc1","lessThan":"5.20.0rc2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:40:06.650125Z","id":"CVE-2026-93349","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/SaiTeja-Erukude/CVE-2026-93349-frictionless-command-injection","source":"disclosure@vulncheck.com"},{"url":"https://github.com/frictionlessdata/frictionless-py/pull/1820","source":"disclosure@vulncheck.com"},{"url":"https://github.com/frictionlessdata/frictionless-py/releases/tag/v5.19.1","source":"disclosure@vulncheck.com"},{"url":"https://github.com/frictionlessdata/frictionless-py/releases/tag/v5.20.0rc2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/frictionless-os-command-injection-via-explore-console-command","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-95842","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T17:17:20.970","lastModified":"2026-09-25T13:34:50.467","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"moquette-io","product":"moquette","versions":[{"version":"< 0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:48:36.420367Z","id":"CVE-2026-95842","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-248"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","versionEndExcluding":"0.18.1","matchCriteriaId":"3C13C0A2-7D78-4742-8861-54D487319A82"}]}]}],"references":[{"url":"https://github.com/moquette-io/moquette/commit/86feb7c31e6fac849c465d8079d08c0e7ef01cdf","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/pull/957","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95843","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T17:17:21.130","lastModified":"2026-09-25T13:34:44.800","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{topicFilter} structure. A remote client can send a filter such as $share/grp without a topic-filter portion, causing a StringIndexOutOfBoundsException while calculating the share name. The exception terminates command handling on the shared session event loop and can deny service to other client sessions assigned to that loop. This issue is fixed in version 0.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"moquette-io","product":"moquette","versions":[{"version":"< 0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:57:47.160479Z","id":"CVE-2026-95843","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","versionEndExcluding":"0.18.1","matchCriteriaId":"3C13C0A2-7D78-4742-8861-54D487319A82"}]}]}],"references":[{"url":"https://github.com/moquette-io/moquette/commit/affdc71fdba92dc020421678970ae70518fb6da2","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/pull/962","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95844","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T17:17:21.280","lastModified":"2026-09-29T02:16:55.810","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a StackOverflowError that disrupts session processing and can deny service to broker clients. This issue is fixed in version 0.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"moquette-io","product":"moquette","versions":[{"version":"< 0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:02:23.767947Z","id":"CVE-2026-95844","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","versionEndExcluding":"0.18.1","matchCriteriaId":"3C13C0A2-7D78-4742-8861-54D487319A82"}]}]}],"references":[{"url":"https://github.com/moquette-io/moquette/commit/ca17e0be19e86d5e291f4532dfdc94616c8e0049","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95845","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T17:17:21.470","lastModified":"2026-09-25T13:34:37.383","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or persistent storage. Remote clients can use this condition to exhaust broker resources and cause a denial of service. This issue is fixed in version 0.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"moquette-io","product":"moquette","versions":[{"version":"< 0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:06:26.358093Z","id":"CVE-2026-95845","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","versionEndExcluding":"0.18.1","matchCriteriaId":"3C13C0A2-7D78-4742-8861-54D487319A82"}]}]}],"references":[{"url":"https://github.com/moquette-io/moquette/commit/2482cadfba44e615be704b892009a57ce06a1aba","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95846","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T17:17:21.627","lastModified":"2026-09-25T13:34:02.580","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client is not permitted to write and cause the broker to publish the unauthorized message when the client disconnects unexpectedly. This issue allows unauthorized message injection into restricted topics. This issue is fixed in version 0.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"moquette-io","product":"moquette","versions":[{"version":"< 0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:21:37.380771Z","id":"CVE-2026-95846","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","versionEndExcluding":"0.18.1","matchCriteriaId":"3C13C0A2-7D78-4742-8861-54D487319A82"}]}]}],"references":[{"url":"https://github.com/moquette-io/moquette/commit/f5a323fe782d1505c0097498cb22eb6ec6c96973","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95847","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T17:17:21.780","lastModified":"2026-09-28T15:23:24.197","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durable session whose client ID ends in _meta can therefore make its message map collide with another client's metadata map. The colliding sessions read and write the same H2 MVStore map with incompatible value types, which can corrupt queue head and tail data and cause message loss, misdelivery, failed queue reloads, or exposure of queued content across sessions. This issue is fixed in version 0.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"moquette-io","product":"moquette","versions":[{"version":"< 0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:50:06.329970Z","id":"CVE-2026-95847","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-99"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","versionEndExcluding":"0.18.1","matchCriteriaId":"3C13C0A2-7D78-4742-8861-54D487319A82"}]}]}],"references":[{"url":"https://github.com/moquette-io/moquette/commit/72d6c8257191d2e4b2e3aa11ab25fd09f88c6cb7","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/pull/964","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-95848","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T17:17:21.947","lastModified":"2026-09-28T15:23:06.303","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failure as though no custom class was configured and fall back to AcceptAllAuthenticator or PermitAllAuthorizatorPolicy. A misspelled class name, missing dependency, constructor failure, or classpath problem can therefore start the broker with authentication or authorization disabled even though the operator configured those controls. This issue is fixed in version 0.18.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"moquette-io","product":"moquette","versions":[{"version":"< 0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:58:35.511233Z","id":"CVE-2026-95848","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-636"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:moquette:moquette:*:*:*:*:*:*:*:*","versionEndExcluding":"0.18.1","matchCriteriaId":"3C13C0A2-7D78-4742-8861-54D487319A82"}]}]}],"references":[{"url":"https://github.com/moquette-io/moquette/commit/14a2f4fd280c8f6a791600c306cbccecb7c67007","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/pull/967","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/moquette-io/moquette/releases/tag/v0.18.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"security-advisories@github.com","tags":["Exploit","Mitigation","Vendor Advisory"]},{"url":"https://github.com/moquette-io/moquette/security/advisories/GHSA-5f42-97gr-vfhq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Mitigation","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96513","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T17:17:22.667","lastModified":"2026-09-23T19:19:53.940","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php. The manipulation of the argument image results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Neethuharii","product":"CafeManagement","cpes":["cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*"],"versions":[{"version":"5f743043a9a04f903678697f061d2e220e544c09","status":"affected"},{"version":"66c837020e25af4866cb69b23ec3af4e0e1510c9","status":"affected"},{"version":"f80fe4442d5e15af5c78df3f22177a131c1e6f32","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:59:22.323978Z","id":"CVE-2026-96513","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://medium.com/@mr.yk404/unauthenticated-arbitrary-file-upload-leading-to-remote-code-execution-in-cafemanagement-df588b716e6f?sharedUserId=mr.yk404","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96513","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/897619","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408919","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408919/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96514","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T17:17:22.853","lastModified":"2026-09-23T20:17:25.800","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Neethuharii","product":"CafeManagement","cpes":["cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*"],"modules":["Login Handler"],"versions":[{"version":"5f743043a9a04f903678697f061d2e220e544c09","status":"affected"},{"version":"66c837020e25af4866cb69b23ec3af4e0e1510c9","status":"affected"},{"version":"f80fe4442d5e15af5c78df3f22177a131c1e6f32","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:55:11.617094Z","id":"CVE-2026-96514","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://medium.com/@mr.yk404/unauthenticated-sql-injection-leading-to-authentication-bypass-in-cafemanagement-php-e64abc2f52da","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96514","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/897624","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408920","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408920/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96651","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-23T17:17:23.187","lastModified":"2026-09-29T18:36:43.750","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Plex","product":"Media Server","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"1.43.3.10861","versionType":"custom","status":"affected"},{"version":"1.43.3.10861","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-09-14T18:18:59.847354Z","id":"CVE-2026-96651","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:34:19.583982Z","id":"CVE-2026-96651","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*","versionEndExcluding":"1.43.0.10861","matchCriteriaId":"48C79D09-D197-4165-B027-8BCCE6CD4861"}]}]}],"references":[{"url":"https://forums.plex.tv/t/plex-media-server/30447/711","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Release Notes"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96651","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://zmain.info/blog/plex2shell","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-96652","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-23T17:17:23.363","lastModified":"2026-10-21T13:09:44.770","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Plex","product":"Media Server","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"1.43.3.10861","versionType":"custom","status":"affected"},{"version":"1.43.3.10861","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-09-14T18:19:53.437351Z","id":"CVE-2026-96652","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-20T00:00:00+00:00","id":"CVE-2026-96652","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-10-20","cisaActionDue":"2026-11-03","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*","versionEndExcluding":"1.43.3.10861","matchCriteriaId":"4C230270-5EBA-476B-84EE-59764545E0FD"}]}]}],"references":[{"url":"https://forums.plex.tv/t/plex-media-server/30447/711","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Release Notes"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96652","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://zmain.info/blog/plex2shell","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-96654","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-23T17:17:23.517","lastModified":"2026-10-21T13:09:37.607","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Plex","product":"Media Server","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"1.43.3.10861","versionType":"custom","status":"affected"},{"version":"1.43.3.10861","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-10-20T15:58:41.367540Z","id":"CVE-2026-96654","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-20T00:00:00+00:00","id":"CVE-2026-96654","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-10-20","cisaActionDue":"2026-10-23","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-84"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*","versionEndExcluding":"1.43.3.10861","matchCriteriaId":"4C230270-5EBA-476B-84EE-59764545E0FD"}]}]}],"references":[{"url":"https://forums.plex.tv/t/plex-media-server/30447/711","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Release Notes"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96654","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://zmain.info/blog/plex2shell","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96654","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-96655","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-23T17:17:23.677","lastModified":"2026-10-21T13:09:29.830","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Plex","product":"Media Server","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"1.43.3.10861","versionType":"custom","status":"affected"},{"version":"1.43.3.10861","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-09-14T18:23:48.400949Z","id":"CVE-2026-96655","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-20T00:00:00+00:00","id":"CVE-2026-96655","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-10-20","cisaActionDue":"2026-11-03","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*","versionEndExcluding":"1.43.3.10861","matchCriteriaId":"4C230270-5EBA-476B-84EE-59764545E0FD"}]}]}],"references":[{"url":"https://forums.plex.tv/t/plex-media-server/30447/711","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Release Notes"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96655","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://zmain.info/blog/plex2shell","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96655","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-96656","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-23T17:17:23.840","lastModified":"2026-10-21T13:09:18.913","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Plex","product":"Media Server","defaultStatus":"unknown","versions":[{"version":"0","lessThan":"1.43.3.10861","versionType":"custom","status":"affected"},{"version":"1.43.3.10861","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-09-14T18:24:56.053053Z","id":"CVE-2026-96656","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-19T00:00:00+00:00","id":"CVE-2026-96656","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"cisaExploitAdd":"2026-10-20","cisaActionDue":"2026-10-23","cisaRequiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cisaVulnerabilityName":"Plex Media Server External Control of File Name or Path Vulnerability","weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*","versionEndExcluding":"1.43.3.10861","matchCriteriaId":"4C230270-5EBA-476B-84EE-59764545E0FD"}]}]}],"references":[{"url":"https://forums.plex.tv/t/plex-media-server/30447/711","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Release Notes"]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-266-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96656","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://zmain.info/blog/plex2shell","source":"9119a7d8-5eab-497f-8521-727c672e3725","tags":["Third Party Advisory"]},{"url":"https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96656","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]}]}},{"cve":{"id":"CVE-2026-96754","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T17:17:24.437","lastModified":"2026-09-29T02:16:56.303","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"orval-labs","product":"orval","defaultStatus":"unaffected","packageURL":"pkg:npm/orval","versions":[{"version":"0","lessThan":"8.29.0","versionType":"semver","status":"affected"},{"version":"8.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T01:59:42.551291Z","id":"CVE-2026-96754","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/orval-labs/orval","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/blob/v8.28.1/packages/hono/src/index.ts#L169-L175","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/commit/155a5b7a38ff6886020cbc4c292db57c2793e6b6","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/pull/4006","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-g4mf-q5hw-f9j9","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/orval-orval-hono-before-8.29.0-code-injection-via-openapi-path","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-g4mf-q5hw-f9j9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96755","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T17:17:24.607","lastModified":"2026-09-23T18:16:08.337","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"orval-labs","product":"orval","defaultStatus":"unaffected","packageURL":"pkg:npm/orval","versions":[{"version":"8.14.0","lessThan":"8.29.0","versionType":"semver","status":"affected"},{"version":"8.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:47:05.260070Z","id":"CVE-2026-96755","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/orval-labs/orval","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/blob/v8.28.1/packages/effect/src/index.ts#L298-L302","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/pull/3995","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/orval-orval-effect-8.14.0-through-8.28.1-code-injection","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96756","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T17:17:24.767","lastModified":"2026-09-23T20:17:27.057","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"orval-labs","product":"orval","defaultStatus":"unaffected","packageURL":"pkg:npm/orval","versions":[{"version":"0","lessThan":"8.30.0","versionType":"semver","status":"affected"},{"version":"8.30.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:11:23.190187Z","id":"CVE-2026-96756","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/orval-labs/orval","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/pull/4038","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96757","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T17:17:24.923","lastModified":"2026-09-23T18:17:12.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"orval-labs","product":"orval","defaultStatus":"unaffected","packageURL":"pkg:npm/orval","versions":[{"version":"6.7.1","lessThan":"8.29.0","versionType":"semver","status":"affected"},{"version":"8.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:47:51.520475Z","id":"CVE-2026-96757","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/orval-labs/orval","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/blob/v8.28.1/packages/fetch/src/index.ts#L584","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/commit/43af282d62dca0ef3140023741fb768f6a718adb","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/commit/a2d4af59f3b167dc8a7a65d15f51cdb89ebe2fe5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/pull/4007","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-4q3x-rqfw-3x8p","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-rcpr-mq4m-jx9j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-unescaped-openapi-media-type","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-4q3x-rqfw-3x8p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96758","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T17:17:25.083","lastModified":"2026-09-23T19:19:54.890","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"orval-labs","product":"orval","defaultStatus":"unaffected","packageURL":"pkg:npm/orval","versions":[{"version":"0","lessThan":"8.28.0","versionType":"semver","status":"affected"},{"version":"8.28.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:59.966755Z","id":"CVE-2026-96758","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/orval-labs/orval","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/blob/v8.27.0/packages/core/src/getters/res-req-types.ts#L808","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/commit/975a769a76151354dead879feadfa3537ff065fe","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/pull/3988","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/orval-orval-core-before-8.28.0-code-injection-via-form-data","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96759","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T17:17:25.250","lastModified":"2026-09-29T02:16:56.497","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"orval-labs","product":"orval","defaultStatus":"unaffected","packageURL":"pkg:npm/orval","versions":[{"version":"0","lessThan":"8.29.0","versionType":"semver","status":"affected"},{"version":"8.29.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:00:51.406766Z","id":"CVE-2026-96759","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/orval-labs/orval","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L784","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448f","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/pull/4008","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-operationid","source":"disclosure@vulncheck.com"},{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96775","sourceIdentifier":"cret@cert.org","published":"2026-09-23T17:17:25.407","lastModified":"2026-09-23T18:17:12.323","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MLflow's dspy flavor, versions >= 2.0,  applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"MLflow","product":"MLflow","versions":[{"version":"2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:22:28.398375Z","id":"CVE-2026-96775","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/369093","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-96804","sourceIdentifier":"cret@cert.org","published":"2026-09-23T17:17:25.530","lastModified":"2026-09-24T04:18:04.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"MLflow","product":"MLflow","versions":[{"version":"2.1","lessThan":"3.15.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-96804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/369093","source":"cret@cert.org"}]}},{"cve":{"id":"CVE-2026-96807","sourceIdentifier":"cve@mitre.org","published":"2026-09-23T17:17:25.703","lastModified":"2026-09-26T23:16:42.380","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files at an arbitrary location. The filenames and content are not attacker controlled, making this hard to exploit."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Flatpak","product":"Flatpak","defaultStatus":"unaffected","platforms":["Linux"],"programFiles":["common/flatpak-run.c"],"programRoutines":[{"name":"regenerate_ld_cache"}],"repo":"https://github.com/flatpak/flatpak","versions":[{"version":"0","lessThan":"1.18.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":4.0,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.4,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:45:37.260895Z","id":"CVE-2026-96807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-61"}]}],"references":[{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-99wv-m8rp-g58x","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-96808","sourceIdentifier":"cve@mitre.org","published":"2026-09-23T17:17:25.860","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by rejecting literal .. components but did not prevent symlink traversal. A malicious local user in an active local session could obtain two revokefs sessions via the system helper, create a symlink in one session pointing into the other session's directory, and retain a file descriptor through that symlink. This allowed the attacker to modify files belonging to a different revokefs session after they had been validated and imported by the system helper. In particular, an attacker could use this to tamper with ostree commit objects in the system repository after they passed signature verification, enabling root-controlled file writes to attacker-chosen paths and local root privilege escalation."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Flatpak","product":"Flatpak","defaultStatus":"unaffected","platforms":["Linux"],"programFiles":["revokefs/writer.c"],"repo":"https://github.com/flatpak/flatpak","versions":[{"version":"0","lessThan":"1.18.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:22:36.969505Z","id":"CVE-2026-96808","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-61"}]}],"references":[{"url":"https://github.com/flatpak/flatpak/security/advisories/GHSA-qrwq-7qwx-q9rp","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-18944","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T18:17:08.590","lastModified":"2026-09-23T18:17:08.590","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-18944. Reason: This candidate is a reservation duplicate of CVE-2026-18944. Notes: All CVE users should reference CVE-2026-18944 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-86867","sourceIdentifier":"cret@cert.org","published":"2026-09-23T18:17:09.323","lastModified":"2026-09-24T15:17:49.290","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester's `user_id` to the conversation's owner `Conversation.user`. This allows any authenticated user to perform the following actions:\r\n1. Read other user's chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions.\r\n2. Permanently delete another user's conversation.\r\n3. Rename another user's conversation.\r\n4. Overwrite another user's conversation's chat suggestion list."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Cinnamon AI","product":"Kotaemon","versions":[{"version":"0.12.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:37:13.797147Z","id":"CVE-2026-86867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/754548","source":"cret@cert.org"},{"url":"https://www.kb.cert.org/vuls/id/754548","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-86926","sourceIdentifier":"product-security@apple.com","published":"2026-09-23T18:17:09.587","lastModified":"2026-10-06T13:09:34.440","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 database file to cause memory corruption, potentially leading to arbitrary code execution. This vulnerability is addressed in FileMaker Server version 26.0.3."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Claris","product":"FileMaker Server","versions":[{"version":"0","lessThan":"26.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:47:07.003686Z","id":"CVE-2026-86926","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:claris:filemaker_server:*:*:*:*:*:*:*:*","versionEndExcluding":"26.0.3","matchCriteriaId":"E5C76BCB-BC4B-4592-8963-B51A7A5C211B"}]}]}],"references":[{"url":"https://support.claris.com/s/answerview?anum=000049219&language=en_US","source":"product-security@apple.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86930","sourceIdentifier":"product-security@apple.com","published":"2026-09-23T18:17:09.720","lastModified":"2026-10-05T18:18:13.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Claris","product":"FileMaker Server","versions":[{"version":"0","lessThan":"26.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:49:24.290341Z","id":"CVE-2026-86930","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:claris:filemaker_server:*:*:*:*:*:*:*:*","versionEndExcluding":"26.0.3","matchCriteriaId":"E5C76BCB-BC4B-4592-8963-B51A7A5C211B"}]}]}],"references":[{"url":"https://support.claris.com/s/answerview?anum=000049218&language=en_US","source":"product-security@apple.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86934","sourceIdentifier":"product-security@apple.com","published":"2026-09-23T18:17:09.847","lastModified":"2026-10-05T18:17:38.370","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Claris","product":"FileMaker Server","versions":[{"version":"0","lessThan":"26.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:39:23.364539Z","id":"CVE-2026-86934","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:claris:filemaker_server:*:*:*:*:*:*:*:*","versionEndExcluding":"26.0.3","matchCriteriaId":"E5C76BCB-BC4B-4592-8963-B51A7A5C211B"}]}]}],"references":[{"url":"https://support.claris.com/s/answerview?anum=000049217&language=en_US","source":"product-security@apple.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86938","sourceIdentifier":"product-security@apple.com","published":"2026-09-23T18:17:09.960","lastModified":"2026-10-05T18:16:13.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMaker Pro version 26.0.3."}],"affected":[{"source":"product-security@apple.com","affectedData":[{"vendor":"Claris","product":"FileMaker Pro","versions":[{"version":"0","lessThan":"26.0.3","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.3,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:43:04.241447Z","id":"CVE-2026-86938","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:claris:filemaker_pro:*:*:*:*:*:*:*:*","versionEndExcluding":"26.0.3","matchCriteriaId":"BB77EB29-9A9B-4DB2-9B5C-9AD4C4944AEF"}]}]}],"references":[{"url":"https://support.claris.com/s/answerview?anum=000049220&language=en_US","source":"product-security@apple.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-88831","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T18:17:10.080","lastModified":"2026-09-25T23:16:54.457","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"busybox-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"1.37.0-9.1.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:08:33.797869Z","id":"CVE-2026-88831","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-636"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:72111","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-88831","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531346","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-88835","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T18:17:10.350","lastModified":"2026-09-25T23:16:54.683","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"busybox-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"1.37.0-9.1.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:14:56.514596Z","id":"CVE-2026-88835","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:72111","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-88835","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531349","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-88837","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T18:17:10.493","lastModified":"2026-09-25T23:16:54.793","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"busybox-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"1.37.0-9.1.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:00:23.871775Z","id":"CVE-2026-88837","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-305"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:72111","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-88837","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531351","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-88839","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T18:17:10.640","lastModified":"2026-09-25T23:16:54.907","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"busybox-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"1.37.0-9.1.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:19:09.117423Z","id":"CVE-2026-88839","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:72111","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-88839","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531353","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-88840","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T18:17:10.790","lastModified":"2026-09-26T23:16:38.490","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"busybox","cpes":["cpe:/a:redhat:hummingbird:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:45:46.757963Z","id":"CVE-2026-88840","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-88840","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531354","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-91775","sourceIdentifier":"help@fluidattacks.com","published":"2026-09-23T18:17:11.097","lastModified":"2026-10-02T18:17:07.090","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface."}],"affected":[{"source":"help@fluidattacks.com","affectedData":[{"vendor":"LimeSurvey","product":"LimeSurvey","defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"versions":[{"version":"7.0.14","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"help@fluidattacks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:43:57.136684Z","id":"CVE-2026-91775","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"help@fluidattacks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://fluidattacks.com/advisories/alone","source":"help@fluidattacks.com"},{"url":"https://github.com/LimeSurvey/LimeSurvey","source":"help@fluidattacks.com"},{"url":"https://github.com/LimeSurvey/LimeSurvey/commit/c96db8093e852eb8b1a2ebbb32478d6fb34cb651","source":"help@fluidattacks.com"},{"url":"https://fluidattacks.com/advisories/alone","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-52744","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:17:30.377","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"gocd","product":"gocd","versions":[{"version":">= 20.2.0, < 26.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:03:51.141165Z","id":"CVE-2026-52744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/gocd/gocd/commit/ce9602d7bb27dcb89bf8fc15eb859306cdc8995c","source":"security-advisories@github.com"},{"url":"https://github.com/gocd/gocd/releases/tag/26.1.0","source":"security-advisories@github.com"},{"url":"https://github.com/gocd/gocd/security/advisories/GHSA-mvpm-hmc9-2q8p","source":"security-advisories@github.com"},{"url":"https://www.gocd.org/releases/#26-1-0","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-55456","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:17:31.657","lastModified":"2026-09-23T19:17:31.657","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE is a duplicate of another CVE."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-55632","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:17:31.733","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names, which can facilitate attacks against those users. The response does not reveal which roles are assigned to each user, and the endpoint cannot modify data. This issue is fixed in version 26.1.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"gocd","product":"gocd","versions":[{"version":">= 20.2.0, < 26.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:05:08.846854Z","id":"CVE-2026-55632","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/gocd/gocd/commit/c93d9e7b32b64257725a7d1c6f148fb571c86c7e","source":"security-advisories@github.com"},{"url":"https://github.com/gocd/gocd/releases/tag/26.1.0","source":"security-advisories@github.com"},{"url":"https://github.com/gocd/gocd/security/advisories/GHSA-57pf-j652-c3c9","source":"security-advisories@github.com"},{"url":"https://www.gocd.org/releases/#26-1-0","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-59990","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:17:32.637","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted. The resulting java.lang.OutOfMemoryError is a fatal Scala error that is not ordinarily handled by scala.util.Try or cats.effect.IO, causing denial of service. This issue is fixed in version 1.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"typelevel","product":"jawn","versions":[{"version":"< 1.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:27:50.740766Z","id":"CVE-2026-59990","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/typelevel/jawn/commit/191cb3a44e77f1afab439ee636bf66bdf3c54a04","source":"security-advisories@github.com"},{"url":"https://github.com/typelevel/jawn/commit/6219666641f9408498f85868f835e17bd8a72fed","source":"security-advisories@github.com"},{"url":"https://github.com/typelevel/jawn/commit/93ac93e9c992c11b4c03d5455d8551f9fb24da1b","source":"security-advisories@github.com"},{"url":"https://github.com/typelevel/jawn/commit/f6ace7e0db715de1a8c4618bed9378333a5c2214","source":"security-advisories@github.com"},{"url":"https://github.com/typelevel/jawn/releases/tag/v1.7.0","source":"security-advisories@github.com"},{"url":"https://github.com/typelevel/jawn/security/advisories/GHSA-cc4v-rvgp-2pf3","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61695","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:17:32.810","lastModified":"2026-09-30T19:38:27.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"square","product":"wire","versions":[{"version":"< 6.4.1","status":"affected"},{"version":">= 7.0.0-alpha01, < 7.0.0-alpha04","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:07:04.183481Z","id":"CVE-2026-61695","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"references":[{"url":"https://github.com/square/wire/commit/24043b6b3a5e5974a978f2745b76d50b31407c1c","source":"security-advisories@github.com"},{"url":"https://github.com/square/wire/commit/81ff7f24a6795d9a8be2e03f272b2d979a5d2c7e","source":"security-advisories@github.com"},{"url":"https://github.com/square/wire/pull/3616","source":"security-advisories@github.com"},{"url":"https://github.com/square/wire/releases/tag/6.4.1","source":"security-advisories@github.com"},{"url":"https://github.com/square/wire/releases/tag/7.0.0-alpha04","source":"security-advisories@github.com"},{"url":"https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9","source":"security-advisories@github.com"},{"url":"https://github.com/square/wire/security/advisories/GHSA-86wm-r4c5-2rc9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61814","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:17:32.970","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"typelevel","product":"jawn","versions":[{"version":"< 1.7.0","status":"affected"}]},{"vendor":"org.typelevel","product":"jawn-parser_2.12","versions":[{"version":"< 1.7.0","status":"affected"}]},{"vendor":"org.typelevel","product":"jawn-parser_2.13","versions":[{"version":"< 1.7.0","status":"affected"}]},{"vendor":"org.typelevel","product":"jawn-parser_3","versions":[{"version":"< 1.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:25:56.569425Z","id":"CVE-2026-61814","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"}]}],"references":[{"url":"https://github.com/typelevel/jawn/commit/cddcd5e3387c356b05953f7b2af103d309687e4b","source":"security-advisories@github.com"},{"url":"https://github.com/typelevel/jawn/releases/tag/v1.7.0","source":"security-advisories@github.com"},{"url":"https://github.com/typelevel/jawn/security/advisories/GHSA-w4cm-gvhj-cgw6","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63131","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:17:34.497","lastModified":"2026-09-29T19:06:32.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's vault/policy/acl.go could evaluate a broader wildcard ACL grant before more-specific trailing-wildcard ACL paths with capabilities = [\"deny\"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could therefore allow listing the denied path. Other operation types are outside the repository advisory's affected scope. This issue is fixed in version 2.6.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openbao","product":"openbao","versions":[{"version":"< 2.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:14:55.010515Z","id":"CVE-2026-63131","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/commit/2e9625d6cebe4639d051ef53dd6ce7c49914ae6a","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/commit/f58d848c139e5ba71aa63103fcfe101972b999fc","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3389","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3474","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/releases/tag/v2.6.0","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-xp3c-3jw3-4vcr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63132","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:17:34.663","lastModified":"2026-09-29T19:06:32.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openbao","product":"openbao","versions":[{"version":"< 2.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:13:35.308605Z","id":"CVE-2026-63132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-208"}]}],"references":[{"url":"https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#203","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/commit/0f2d90c331f25d1c6cd108638da03f4c7bd949a8","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/commit/763625a2072103ea9e9122f2a8408e0b988d287a","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3388","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3472","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/releases/tag/v2.6.0","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-34fc-gh42-pj53","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-71458","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:01.477","lastModified":"2026-09-24T07:16:32.270","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"URLModificationMiddleware resolves named-URL lookups\n              against unfiltered Model.objects before RBAC. The 403→404\n              shim only rewrites 403 responses, leaving the pk=0 miss\n              path with a different 404 detail string. Differential\n              \"Not found.\" vs \"No <Model> matches...\" reveals whether\n              a named resource (org, credential, inventory, host) exists\n              anywhere on the platform. Enables cross-tenant internal\n              hostname enumeration."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:11:28.070594Z","id":"CVE-2026-71458","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-204"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71458","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512367","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71459","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:02.180","lastModified":"2026-09-25T18:17:30.563","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"JobJobEventsChildrenSummary view has no model/parent_model.\n              ModelAccessPermission.check_get_permissions() falls through\n              (returns True) for any authenticated user. The view uses\n              raw get_object_or_404(Job, pk) without DRF object-level\n              permission check. Zero-privilege user reads event tree\n              structure, event_processing_finished status, and enumerates\n              Job IDs platform-wide via 200/404 oracle. Sibling endpoint\n              /jobs/{id}/job_events/ correctly returns 403."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:11:07.236082Z","id":"CVE-2026-71459","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71459","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512368","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71460","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:02.410","lastModified":"2026-09-24T07:16:32.527","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"/api/v2/config/ is protected only by IsAuthenticated.\n              license_info (account_number, subscription_id, pool_id,\n              sku, support_level, instance counts) returned to any\n              authenticated user. The superuser/auditor gate only covers\n              project_base_dir/project_local_paths/custom_virtualenvs,\n              not license_info. Enables social engineering against\n              Red Hat support and estate sizing reconnaissance."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:04:52.078230Z","id":"CVE-2026-71460","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71460","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512369","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71461","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:02.953","lastModified":"2026-10-16T12:16:40.097","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HostList.list() catches bare Exception and returns str(e)\n              verbatim. Via host_filter, any authenticated user triggers\n              Django FieldError (leaking complete Host model relation\n              graph including internal reverse accessors) or PostgreSQL\n              DataError (leaking raw database error strings). Two\n              primitives: credential__search=x dumps ORM schema,\n              name__regex=[bad reflects PostgreSQL errors."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:46:06.825079Z","id":"CVE-2026-71461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-209"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71461","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512370","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71462","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:03.090","lastModified":"2026-09-24T07:16:32.787","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"StringListPathField.to_internal_value() calls\n              os.path.exists() on unbounded user-supplied paths.\n              200 vs 400 response reveals existence of arbitrary\n              absolute paths on the controller-web pod. Tenant\n              superuser can confirm /etc/tower/SECRET_KEY, k8s\n              service-account token, receptor sockets, ConfigMap\n              mount points. Mainly impactful on managed AAP\n              (ansiblecloud.com) where tenant admin != host admin."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:31:20.113468Z","id":"CVE-2026-71462","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-204"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71462","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512371","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71463","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:03.227","lastModified":"2026-09-25T19:17:56.973","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Notification template Jinja AST whitelist only inspects\n              static Getattr nodes. Dynamic subscripts (job['job'+'_env'])\n              and {% if job.id > 100 %} conditional gating bypass both\n              the AST check and the test-render (stub has small job.id).\n              At runtime, the gated branch executes and exceptions write\n              full tracebacks into notification body, which is POSTed\n              to attacker-controlled webhook URL. Leaks install paths,\n              Python version, source line numbers."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:13:44.747883Z","id":"CVE-2026-71463","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-209"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71463","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512372","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71464","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:03.363","lastModified":"2026-09-24T14:51:56.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"LaunchConfigurationBaseSerializer.scm_branch has no\n              validate_scm_branch() leading-dash check, unlike\n              Project/JobTemplate/JobLaunch serializers. Schedule and\n              WFJT Node accept --upload-pack=/bin/id as scm_branch.\n              Currently blocked at runtime by jobs.py:1502 ValueError\n              check (defense-in-depth), but the API validation gap\n              means sole reliance on a task-layer guard. Refactoring\n              that guard away would promote this to RCE."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:27:23.789856Z","id":"CVE-2026-71464","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71464","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512374","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-71465","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:03.500","lastModified":"2026-09-24T14:51:56.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"RunAdHocCommand.build_args() appends limit as bare\n              positional (args.append(limit)) instead of using\n              args.extend(['-l', limit]) like RunJob. A limit beginning\n              with - is parsed as an ansible CLI option. Currently\n              limited to short-circuit flags (--version, --help) since\n              injected element displaces required pattern positional.\n              Would escalate if ansible-core ever defaults pattern."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:04:48.678853Z","id":"CVE-2026-71465","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-71465","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512375","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-75131","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T19:19:14.073","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a crafted VPN username. Attackers can embed a double-quote character or whitespace in the username to break out of the pppd options file quoting context and include the pppd plugin directive, causing the privileged pppd process to load an attacker-controlled shared object."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"nm-l2tp","product":"NetworkManager-l2tp","defaultStatus":"unaffected","repo":"https://github.com/nm-l2tp/NetworkManager-l2tp","packageURL":"pkg:github/nm-l2tp/NetworkManager-l2tp","versions":[{"version":"0","lessThanOrEqual":"1.52.4","versionType":"semver","status":"affected"},{"version":"1.52.6","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:35:37.954356Z","id":"CVE-2026-75131","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-v2wj-xr2m-xc4j","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/networkmanager-l2tp-privilege-escalation-via-pppd-username-injection","source":"disclosure@vulncheck.com"},{"url":"https://github.com/nm-l2tp/NetworkManager-l2tp/security/advisories/GHSA-v2wj-xr2m-xc4j","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-76086","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:14.393","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration permissions and passes request-supplied settings to a configured integration. An authenticated attacker can replace outbound host properties such as apiUrl while the server uses stored API keys or OAuth tokens, causing non-blind server-side requests to an attacker-controlled or internal host and returning the remote response. This residual flaw remained because the permission gate added in version 3.1.28 excluded the form-settings action. Sites that permit low-privileged or front-end user authentication can therefore expose integration credentials and internal network responses. This issue is fixed in versions 2.2.23 and 3.1.31."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"verbb","product":"formie","versions":[{"version":"< 2.2.23","status":"affected"},{"version":">= 3.0.0, < 3.1.31","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:06:10.900244Z","id":"CVE-2026-76086","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-915"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/advisories/GHSA-cvpc-hccg-wmw4","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/commit/6735fe4ae8f6a2a76930716ad7876b236f7c530d","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/commit/dde7799dfa7e4d0a11e28754ad8544dba62d5def","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/releases/tag/2.2.23","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/releases/tag/3.1.31","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/security/advisories/GHSA-v3f3-cmj4-cvj9","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-76087","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:14.570","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session binding, ownership validation, or a valid submissionEditToken. An unauthenticated attacker can enumerate sequential IDs and overwrite or hijack another user's in-progress multi-page or save-for-later submission, and the modified data can be persisted and forwarded through notifications or integrations when the submission is completed. This is an incomplete remediation of CVE-2026-47266 because that earlier change validated edit tokens for save-submission but did not protect submit. Completed submissions are excluded by the isIncomplete filter. This issue is fixed in versions 2.2.23 and 3.1.31."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"verbb","product":"formie","versions":[{"version":"< 2.2.23","status":"affected"},{"version":">= 3.0.0, < 3.1.31","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:12:07.675345Z","id":"CVE-2026-76087","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/verbb/formie/commit/323c2fe647a76fbccadf749728ee4ad9420efee1","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/commit/78a298ac3baf85ac283988dfce9cd42c9b958f16","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/releases/tag/2.2.23","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/releases/tag/3.1.31","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/security/advisories/GHSA-584p-f93j-wpgc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-76089","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:14.720","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID without permission or object-level authorization checks. Any authenticated user able to invoke the action can enumerate notification IDs and read recipient headers and complete HTML email bodies containing submitted form data, even without the sent-notification viewing permission. This issue is fixed in versions 2.2.23 and 3.1.31."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"verbb","product":"formie","versions":[{"version":"< 2.2.23","status":"affected"},{"version":">= 3.0.0, < 3.1.31","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:04:50.083865Z","id":"CVE-2026-76089","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/verbb/formie/commit/9f4e23c36b907ed7677563231eaba373fdb8b84b","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/commit/ff81a895fa91a2e4efb8d4714501ba2d92df0b76","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/releases/tag/2.2.23","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/releases/tag/3.1.31","source":"security-advisories@github.com"},{"url":"https://github.com/verbb/formie/security/advisories/GHSA-9rg8-2wvr-fgjh","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-76648","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:15.030","lastModified":"2026-10-16T12:16:40.530","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes =\n(IsAuthenticated,), so DRF's get_object() performs no object-level\nRBAC. The get() handler (lines 988–991) explicitly guards with\nrequest.user.can_access(obj._class_, 'read', obj) — but post()\n(lines 1001–1010) does not. POST only checks:\n\ncan_access(model, 'add', create_kwargs_check)\n\ncan_access(model, 'copy_related', obj)\n\nFor JobTemplate, can_add (awx/awx/main/access.py:1465–1520) gates on\n\ninventory.use_role + project.use_role +\nexecution_environment.read_role — resource-level roles that do not\nimply read on the source JT — and can_copy_related (1522–1534) checks\nonly credentials.use_role. None of these imply the caller can read the\nsource JT."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller-cli","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:45:56.874201Z","id":"CVE-2026-76648","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-76648","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2519720","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-77285","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:15.180","lastModified":"2026-09-29T19:06:32.333","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openbao","product":"openbao","versions":[{"version":"< 2.6.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:L/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.4,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:23:49.168615Z","id":"CVE-2026-77285","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://github.com/openbao/openbao/commit/90272575e5f58b3883fbb0ccb2238e9285722d1a","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/commit/ee3aa4aff72c5176cf02af21eac7158899080878","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3494","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/pull/3495","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/releases/tag/v2.6.0","source":"security-advisories@github.com"},{"url":"https://github.com/openbao/openbao/security/advisories/GHSA-444v-8vxr-p36h","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-77394","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:15.343","lastModified":"2026-09-23T20:17:15.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"OpenC3","product":"cosmos","versions":[{"version":">= 5.0.6, < 7.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:27:36.468261Z","id":"CVE-2026-77394","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/OpenC3/cosmos/commit/10371f8f410b9ad588f98dfa3befaaacb6587cd3","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/pull/3560","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/releases/tag/v7.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/security/advisories/GHSA-gvf2-2rh5-mpgf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77420","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:15.510","lastModified":"2026-09-30T19:38:27.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"jline","product":"jline3","versions":[{"version":">= 3.0.0, < 3.30.15","status":"affected"},{"version":">= 4.0.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:05:00.790615Z","id":"CVE-2026-77420","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/pull/2012","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/pull/2018","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/releases/tag/4.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/releases/tag/jline-3.30.15","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/security/advisories/GHSA-5q95-hrpc-m3w3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77421","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:15.700","lastModified":"2026-09-30T16:44:39.840","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearch(String text) in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression engine without a timeout or backtracking bound. A nested-quantifier expression evaluated against non-matching buffer content can consume excessive CPU and indefinitely block the editor session thread, and remote multi-user deployments can lose a worker thread for each affected session. This issue is fixed in versions 3.30.15 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"jline","product":"jline3","versions":[{"version":">= 3.0.0, < 3.30.15","status":"affected"},{"version":">= 4.0.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:05:07.485942Z","id":"CVE-2026-77421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/pull/2012","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/pull/2018","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/releases/tag/4.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/releases/tag/jline-3.30.15","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/security/advisories/GHSA-ph9c-7hw9-vhhw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-77422","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:15.863","lastModified":"2026-09-30T16:44:39.840","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"jline","product":"jline3","versions":[{"version":">= 3.0.0, < 3.30.15","status":"affected"},{"version":">= 4.0.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:13:32.954382Z","id":"CVE-2026-77422","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/pull/2012","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/pull/2018","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/releases/tag/4.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/releases/tag/jline-3.30.15","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/security/advisories/GHSA-r2xf-8xr9-62gw","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77423","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:16.017","lastModified":"2026-09-30T16:44:39.840","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"jline","product":"jline3","versions":[{"version":">= 3.0.0, < 3.30.15","status":"affected"},{"version":">= 4.0.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:10:41.490849Z","id":"CVE-2026-77423","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/jline/jline3/commit/1d5fc3099e77938b971e197211cad2d4fbb17541","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/commit/341ee69ccc57b7733c1b40d6993219b64b3206ae","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/pull/2012","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/pull/2018","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/releases/tag/4.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/releases/tag/jline-3.30.15","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/security/advisories/GHSA-2v9w-34q6-wpqx","source":"security-advisories@github.com"},{"url":"https://github.com/jline/jline3/security/advisories/GHSA-2v9w-34q6-wpqx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77601","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:18.380","lastModified":"2026-09-23T20:17:16.027","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting through set_setting at POST /openc3-api/api, then cause OpenC3::PluginModel.install_phase2 in openc3/lib/openc3/models/plugin_model.rb to interpolate the value into a shell command while installing a plugin with Python dependency metadata. Shell metacharacters in the setting are interpreted by the command shell, allowing arbitrary operating-system commands to run as the openc3 service user with access to Redis and bucket credentials. Open-source deployments permit any authenticated user to reach the affected operations, while Enterprise deployments require an administrator. This issue is fixed in version 7.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"OpenC3","product":"cosmos","versions":[{"version":">= 5.12.0, < 7.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:28:30.534617Z","id":"CVE-2026-77601","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/OpenC3/cosmos/commit/be70d1d836c83c3b084e768e31a399312d4cbe0b","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/pull/3489","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/security/advisories/GHSA-vp3w-52v9-q57f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77602","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:18.550","lastModified":"2026-09-29T03:17:17.883","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3.0, authenticated non-administrator users can write content under targets_modified/ that is later executed by multiple configuration paths below the intended code-execution privilege tier. Table and command or telemetry definitions are processed through ConfigParser, PacketConfig, GENERIC_READ_CONVERSION, or GENERIC_WRITE_CONVERSION, allowing ERB rendering or Ruby and Python evaluation, while openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb executes suite procedure files through require. Storage uploads, screen saves, and script creation can place content in the overlay, and triggering table processing, a cmd/tlm reload, or suite analysis executes the content in cmd-tlm-api, decom microservices, or Script Runner with access to internal credentials and data. This issue is fixed in version 7.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"OpenC3","product":"cosmos","versions":[{"version":">= 5.1.0, < 7.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:08:58.163563Z","id":"CVE-2026-77602","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/OpenC3/cosmos/commit/71943352a28128ef3e7e894319d97a656b5cd4f2","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/commit/7a1538a4626f82c0d1540fcaa27ffdcbbd71ff81","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/pull/3488","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/security/advisories/GHSA-jjq7-m736-w977","source":"security-advisories@github.com"},{"url":"https://github.com/OpenC3/cosmos/security/advisories/GHSA-jjq7-m736-w977","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-82356","sourceIdentifier":"cret@cert.org","published":"2026-09-23T19:19:34.620","lastModified":"2026-09-25T14:10:13.927","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Imprivata","product":"Imprivata Enterprise Access Management","versions":[{"version":"0.0.0","lessThanOrEqual":"26.2.6","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:37:07.114927Z","id":"CVE-2026-82356","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-326"},{"lang":"en","value":"CWE-327"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/273940","source":"cret@cert.org"},{"url":"https://www.kb.cert.org/vuls/id/273940","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-82368","sourceIdentifier":"sirt@brocade.com","published":"2026-09-23T19:19:34.747","lastModified":"2026-10-01T21:17:24.807","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to communicate directly with backend management services. A local attacker can leverage this exposed access to transmit commands to connected Fabric OS switches under the security context of the SANnav management user."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.0.1a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.0.1a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:33:38.082944Z","id":"CVE-2026-82368","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38993","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-84474","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:39.930","lastModified":"2026-09-24T06:17:01.990","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The provisioning-callback secret (host_config_key) is exposed to\nusers holding only the read-level view_jobtemplate permission -- both in the\njob template API representation and in the activity stream -- and the\nprovisioning callback endpoint trusts a client-supplied X-Forwarded-For\nheader to determine the calling host when the controller is deployed behind\nthe AAP gateway with an empty proxy allow-list. By reading the secret and\nspoofing X-Forwarded-For to match any host in the job template's inventory, a\nminimally privileged or unauthenticated remote attacker can launch the job\ntemplate against arbitrary managed hosts using the job template's credentials,\nresulting in privilege escalation and remote code execution on managed hosts."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"],"versions":[{"version":"0:4.5.36-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"],"versions":[{"version":"0:4.5.36-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:28:08.444949Z","id":"CVE-2026-84474","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-807"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71115","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84474","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527073","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84486","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:40.093","lastModified":"2026-09-24T06:17:02.153","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Four debug views that trigger the internal task, dependency, and\nworkflow schedulers are configured to allow any user (including unauthenticated\nclients) and are routed in production builds because their URL include is not\ngated on the debug setting. An unauthenticated remote attacker can repeatedly\ninvoke these endpoints to acquire the cluster-wide scheduler advisory lock;\nbecause the legitimate scheduler acquires the same lock without waiting, the\nattacker causes real scheduler runs to be skipped, stalling job dispatch for\nall tenants, while also consuming controller web workers. The debug root view\nadditionally discloses the list of debug endpoints to unauthenticated callers."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:26:33.390389Z","id":"CVE-2026-84486","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-489"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84486","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527085","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84499","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:40.233","lastModified":"2026-09-26T23:16:37.690","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. Survey questions of type password are write-only and stored\nencrypted, displayed only as a placeholder on read. When a schedule or\nworkflow job template node is revalidated against a tightened survey\nspecification, the controller decrypts the stored password and includes its\nplaintext value in the minimum/maximum length validation error message\nreturned in the HTTP response. A user with the delegated JobTemplate Admin\nrole can tighten the survey length constraint and trigger revalidation of a\nschedule or node created by another, higher-privileged user, thereby\nrecovering that user's stored password in plaintext."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:46:18.461757Z","id":"CVE-2026-84499","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-209"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84499","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527090","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84502","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:40.377","lastModified":"2026-09-24T06:17:02.273","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The Project scm_url field is not validated against values that\nbegin with a dash and is stored and passed verbatim to the git SCM module.\nBecause the module runs git ls-remote with the URL as a positional argument and\nwithout a \"--\" separator, a git project URL such as \"--upload-pack=<command>:x\"\nis interpreted by git as the --upload-pack option and executed via a shell. A\nuser with permission to create or modify a project in a single organization can\nthereby execute arbitrary commands on the control-plane task pod, with output\nreflected through the project update stdout endpoint, leading to cross-tenant\ncompromise and in-cluster lateral movement"}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"],"versions":[{"version":"0:4.5.36-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"],"versions":[{"version":"0:4.5.36-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:29:36.460336Z","id":"CVE-2026-84502","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71115","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84502","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527096","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-90899","sourceIdentifier":"security@joomla.org","published":"2026-09-23T19:19:42.873","lastModified":"2026-09-23T20:17:20.977","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomshaper.com","product":"Easy Store extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:36:29.238374Z","id":"CVE-2026-90899","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.joomshaper.com/easystore","source":"security@joomla.org"}]}},{"cve":{"id":"CVE-2026-90900","sourceIdentifier":"security@joomla.org","published":"2026-09-23T19:19:43.020","lastModified":"2026-09-23T20:17:21.103","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomshaper.com","product":"Easy Store extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:32:35.989396Z","id":"CVE-2026-90900","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://www.joomshaper.com/easystore","source":"security@joomla.org"}]}},{"cve":{"id":"CVE-2026-90901","sourceIdentifier":"security@joomla.org","published":"2026-09-23T19:19:43.150","lastModified":"2026-09-25T18:17:32.110","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 -  The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomshaper.com","product":"Easy Store extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:34:17.625210Z","id":"CVE-2026-90901","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.joomshaper.com/easystore","source":"security@joomla.org"}]}},{"cve":{"id":"CVE-2026-90902","sourceIdentifier":"security@joomla.org","published":"2026-09-23T19:19:43.283","lastModified":"2026-09-25T18:17:32.240","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and directly concatenated them into raw SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator could manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers (array_map('intval', ...)) and adopting parameterized ->whereIn() query construction."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomshaper.com","product":"Easy Store extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:33:17.712297Z","id":"CVE-2026-90902","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.joomshaper.com/easystore","source":"security@joomla.org"}]}},{"cve":{"id":"CVE-2026-90903","sourceIdentifier":"security@joomla.org","published":"2026-09-23T19:19:43.417","lastModified":"2026-09-23T20:17:21.483","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, and collections) accepted state-changing requests without checking anti-CSRF tokens. An attacker could trick a logged-in administrator into triggering unauthorized state modifications across the store backend. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) via Session::checkToken()."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomshaper.com","product":"Easy Store extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:34:36.134524Z","id":"CVE-2026-90903","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://www.joomshaper.com/easystore","source":"security@joomla.org"}]}},{"cve":{"id":"CVE-2026-90904","sourceIdentifier":"security@joomla.org","published":"2026-09-23T19:19:43.543","lastModified":"2026-09-23T20:17:21.633","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomshaper.com","product":"Easy Store extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:32:53.703988Z","id":"CVE-2026-90904","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://www.joomshaper.com/easystore","source":"security@joomla.org"}]}},{"cve":{"id":"CVE-2026-90905","sourceIdentifier":"security@joomla.org","published":"2026-09-23T19:19:43.673","lastModified":"2026-09-23T20:17:21.770","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin()."}],"affected":[{"source":"security@joomla.org","affectedData":[{"vendor":"joomshaper.com","product":"Easy Store extension for Joomla","defaultStatus":"unaffected","versions":[{"version":"1.0.0-3.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@joomla.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:33:58.362250Z","id":"CVE-2026-90905","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@joomla.org","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://www.joomshaper.com/easystore","source":"security@joomla.org"}]}},{"cve":{"id":"CVE-2026-92284","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:43.940","lastModified":"2026-09-30T16:42:45.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"caddyserver","product":"caddy","versions":[{"version":"<= 2.11.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:18:11.334797Z","id":"CVE-2026-92284","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9","source":"security-advisories@github.com"},{"url":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92692","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:44.103","lastModified":"2026-09-23T20:17:22.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sulu","product":"sulu","versions":[{"version":"< 2.6.25","status":"affected"},{"version":">= 3.0.0, < 3.0.8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:34:14.134968Z","id":"CVE-2026-92692","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/sulu/sulu/commit/d19c01487af8c3de2fb3aa145856707a6367392c","source":"security-advisories@github.com"},{"url":"https://github.com/sulu/sulu/releases/tag/2.6.25","source":"security-advisories@github.com"},{"url":"https://github.com/sulu/sulu/releases/tag/3.0.8","source":"security-advisories@github.com"},{"url":"https://github.com/sulu/sulu/security/advisories/GHSA-jg26-q8hg-3pq4","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-92700","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:44.280","lastModified":"2026-09-30T16:42:45.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"caddyserver","product":"caddy","versions":[{"version":"<= 2.11.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:22:40.555126Z","id":"CVE-2026-92700","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-178"}]}],"references":[{"url":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9","source":"security-advisories@github.com"},{"url":"https://github.com/caddyserver/caddy/security/advisories/GHSA-j8px-rmrx-76h9","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92730","sourceIdentifier":"help@fluidattacks.com","published":"2026-09-23T19:19:44.430","lastModified":"2026-09-23T20:17:22.383","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page."}],"affected":[{"source":"help@fluidattacks.com","affectedData":[{"vendor":"LimeSurvey","product":"LimeSurvey","defaultStatus":"unaffected","platforms":["Windows","MacOS","Linux"],"versions":[{"version":"7.0.14","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"help@fluidattacks.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:32:16.500697Z","id":"CVE-2026-92730","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"help@fluidattacks.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://fluidattacks.com/es/advisories/camisa","source":"help@fluidattacks.com"},{"url":"https://github.com/LimeSurvey/LimeSurvey/","source":"help@fluidattacks.com"},{"url":"https://github.com/LimeSurvey/LimeSurvey/commit/0523de7bbb0282af33a0bf9e08a1fc6333ae6851","source":"help@fluidattacks.com"}]}},{"cve":{"id":"CVE-2026-93421","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T19:19:45.140","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mesop-dev","product":"mesop","versions":[{"version":"< 1.3.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:25:37.624256Z","id":"CVE-2026-93421","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-117"},{"lang":"en","value":"CWE-150"}]}],"references":[{"url":"https://github.com/mesop-dev/mesop/commit/f38c42a1d3eba246941ef8d7f645072d53c58785","source":"security-advisories@github.com"},{"url":"https://github.com/mesop-dev/mesop/pull/1397","source":"security-advisories@github.com"},{"url":"https://github.com/mesop-dev/mesop/releases/tag/v1.3.4","source":"security-advisories@github.com"},{"url":"https://github.com/mesop-dev/mesop/security/advisories/GHSA-g7f6-rxc4-qhph","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-93513","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:45.297","lastModified":"2026-09-23T20:17:22.620","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"SiteSkite","product":"SiteSkite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"siteskite","versions":[{"version":"n/a","lessThanOrEqual":"2.1.7","versionType":"custom","status":"affected","changes":[{"at":"2.1.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:05:05.826932Z","id":"CVE-2026-93513","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/siteskite/vulnerability/wordpress-siteskite-plugin-2-1-7-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93526","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:45.437","lastModified":"2026-09-23T20:17:22.727","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nexcess","product":"Event Tickets","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"event-tickets","versions":[{"version":"n/a","lessThanOrEqual":"5.29.4","versionType":"custom","status":"affected","changes":[{"at":"5.29.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:01:19.306425Z","id":"CVE-2026-93526","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/event-tickets/vulnerability/wordpress-event-tickets-plugin-5-29-4-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93527","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:45.573","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"bdthemes","product":"Live Copy Paste for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"live-copy-paste","versions":[{"version":"n/a","lessThanOrEqual":"1.5.10","versionType":"custom","status":"affected","changes":[{"at":"1.5.11","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:37:49.765569Z","id":"CVE-2026-93527","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/live-copy-paste/vulnerability/wordpress-live-copy-paste-for-elementor-plugin-1-5-10-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93529","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:45.717","lastModified":"2026-09-23T20:17:22.837","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Broken Access Control in WSP MCP &#8211; AI Agents Connector <= 2.7.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Bilal Naseer","product":"WSP MCP &#8211; AI Agents Connector","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wsp-mcp-ai-agents-connector","versions":[{"version":"n/a","lessThanOrEqual":"2.7.0","versionType":"custom","status":"affected","changes":[{"at":"2.7.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:24:44.887560Z","id":"CVE-2026-93529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wsp-mcp-ai-agents-connector/vulnerability/wordpress-wsp-mcp-8211-ai-agents-connector-plugin-2-7-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93618","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:45.853","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS.\n\nThis issue affects JetTricks: from n/a through 2.0.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Crocoblock. Jetimpex Inc.","product":"JetTricks","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThanOrEqual":"2.0.1","versionType":"custom","status":"affected","changes":[{"at":"2.0.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:37:17.001177Z","id":"CVE-2026-93618","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/jet-tricks/vulnerability/wordpress-jettricks-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93620","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:46.040","lastModified":"2026-09-23T20:17:22.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PayPlus Tech Team","product":"PayPlus Payment Gateway","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"payplus-payment-gateway","versions":[{"version":"n/a","lessThanOrEqual":"8.2.5","versionType":"custom","status":"affected","changes":[{"at":"8.2.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:06:12.486562Z","id":"CVE-2026-93620","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/payplus-payment-gateway/vulnerability/wordpress-payplus-payment-gateway-plugin-8-2-5-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93622","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:46.180","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"NicolasKulka","product":"WPS Limit Login","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wps-limit-login","versions":[{"version":"n/a","lessThanOrEqual":"1.5.9.3","versionType":"custom","status":"affected","changes":[{"at":"1.5.9.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:59:41.036558Z","id":"CVE-2026-93622","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wps-limit-login/vulnerability/wordpress-wps-limit-login-plugin-1-5-9-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93623","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:46.327","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jordy Meow","product":"AI Engine","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ai-engine","versions":[{"version":"n/a","lessThanOrEqual":"3.7.8","versionType":"custom","status":"affected","changes":[{"at":"3.7.9","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:45.914342Z","id":"CVE-2026-93623","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ai-engine/vulnerability/wordpress-ai-engine-plugin-3-7-8-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93772","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:46.480","lastModified":"2026-09-23T20:17:23.240","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Tomdever","product":"wpForo Forum","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wpforo","versions":[{"version":"n/a","lessThanOrEqual":"3.1.5","versionType":"custom","status":"affected","changes":[{"at":"3.1.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:24:59.024441Z","id":"CVE-2026-93772","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wpforo/vulnerability/wordpress-wpforo-forum-plugin-3-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93773","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:46.613","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor SQL Injection in Mollie Forms <= 2.11.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Nick van Wobbie","product":"Mollie Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mollie-forms","versions":[{"version":"n/a","lessThanOrEqual":"2.11.0","versionType":"custom","status":"affected","changes":[{"at":"2.11.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:39.952562Z","id":"CVE-2026-93773","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mollie-forms/vulnerability/wordpress-mollie-forms-plugin-2-11-0-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-93774","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:46.753","lastModified":"2026-09-23T20:17:23.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Jacob N. Breetvelt","product":"WP Photo Album Plus","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-photo-album-plus","versions":[{"version":"n/a","lessThanOrEqual":"9.3.02.002","versionType":"custom","status":"affected","changes":[{"at":"9.3.02.003","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:05:03.526572Z","id":"CVE-2026-93774","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-photo-album-plus/vulnerability/wordpress-wp-photo-album-plus-plugin-9-3-02-002-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94079","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:47.143","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WP User Manager","product":"WP User Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-manager","versions":[{"version":"n/a","lessThanOrEqual":"2.9.19","versionType":"custom","status":"affected","changes":[{"at":"2.9.20","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:55:30.648371Z","id":"CVE-2026-94079","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-manager/vulnerability/wordpress-wp-user-manager-plugin-2-9-19-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94080","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:47.647","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WebWizards","product":"MarketKing","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"marketking-multivendor-marketplace-for-woocommerce","versions":[{"version":"n/a","lessThanOrEqual":"2.1.70","versionType":"custom","status":"affected","changes":[{"at":"2.1.72","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:34.991434Z","id":"CVE-2026-94080","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/marketking-multivendor-marketplace-for-woocommerce/vulnerability/wordpress-marketking-plugin-2-1-70-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94118","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:47.797","lastModified":"2026-09-23T20:17:23.463","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Leap13","product":"Premium Blocks – Gutenberg Blocks for WordPress","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"premium-blocks-for-gutenberg","versions":[{"version":"n/a","lessThanOrEqual":"2.3.17","versionType":"custom","status":"affected","changes":[{"at":"2.3.18","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:25:14.866596Z","id":"CVE-2026-94118","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/premium-blocks-for-gutenberg/vulnerability/wordpress-premium-blocks-gutenberg-blocks-for-wordpress-plugin-2-3-17-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94124","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:47.940","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor SQL Injection in WP EasyCart <= 5.9.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"levelfourdevelopment","product":"WP EasyCart","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-easycart","versions":[{"version":"n/a","lessThanOrEqual":"5.9.4","versionType":"custom","status":"affected","changes":[{"at":"6.0.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:28.820976Z","id":"CVE-2026-94124","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-easycart/vulnerability/wordpress-wp-easycart-plugin-5-9-4-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94168","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:48.130","lastModified":"2026-09-23T20:17:23.577","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Leap13","product":"Premium Addons for Elementor","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"premium-addons-for-elementor","versions":[{"version":"n/a","lessThanOrEqual":"4.11.105","versionType":"custom","status":"affected","changes":[{"at":"4.11.106","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:05:00.420783Z","id":"CVE-2026-94168","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/premium-addons-for-elementor/vulnerability/wordpress-premium-addons-for-elementor-plugin-4-11-105-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94174","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:48.277","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Administrator SQL Injection in Email Log <= 2.63 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WebFactory","product":"Email Log","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"email-log","versions":[{"version":"n/a","lessThanOrEqual":"2.63","versionType":"custom","status":"affected","changes":[{"at":"2.64","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:53:30.806407Z","id":"CVE-2026-94174","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/email-log/vulnerability/wordpress-email-log-plugin-2-63-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94176","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:48.453","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kitae Park","product":"Mang Board WP","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"mangboard","versions":[{"version":"n/a","lessThanOrEqual":"2.4.1","versionType":"custom","status":"affected","changes":[{"at":"2.4.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:24.862475Z","id":"CVE-2026-94176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/mangboard/vulnerability/wordpress-mang-board-wp-plugin-2-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94179","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:48.630","lastModified":"2026-09-23T20:17:23.687","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Razorpay","product":"Razorpay Payment Button","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"razorpay-payment-button","versions":[{"version":"n/a","lessThanOrEqual":"2.4.9","versionType":"custom","status":"affected","changes":[{"at":"2.5.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:25:30.710475Z","id":"CVE-2026-94179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/razorpay-payment-button/vulnerability/wordpress-razorpay-payment-button-plugin-2-4-9-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94181","sourceIdentifier":"59469e6c-7ea7-446f-8e43-06aa32c115e8","published":"2026-09-23T19:19:48.763","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification."}],"affected":[{"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","affectedData":[{"vendor":"The Browser Company of New York","product":"Arc","defaultStatus":"unaffected","platforms":["MacOS"],"versions":[{"version":"0","lessThan":"1.159.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:35:29.822010Z","id":"CVE-2026-94181","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"references":[{"url":"https://arc.net/security/bulletins#cve-2026-94181-address-bar-spoof-risk-missing-fullscreen-notification-via-select-element","source":"59469e6c-7ea7-446f-8e43-06aa32c115e8"},{"url":"https://hackerone.com/reports/3711701","source":"59469e6c-7ea7-446f-8e43-06aa32c115e8"}]}},{"cve":{"id":"CVE-2026-94391","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:49.110","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Rustaurius","product":"Ultimate FAQ","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ultimate-faqs","versions":[{"version":"n/a","lessThanOrEqual":"2.4.14","versionType":"custom","status":"affected","changes":[{"at":"2.5.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:21.458349Z","id":"CVE-2026-94391","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ultimate-faqs/vulnerability/wordpress-ultimate-faq-plugin-2-4-14-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94457","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:49.253","lastModified":"2026-09-23T20:17:24.047","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WebFactory","product":"Captcha Code","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"captcha-code-authentication","versions":[{"version":"n/a","lessThanOrEqual":"3.32","versionType":"custom","status":"affected","changes":[{"at":"3.33","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:04:57.450694Z","id":"CVE-2026-94457","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/captcha-code-authentication/vulnerability/wordpress-captcha-code-plugin-3-32-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94461","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:49.390","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"metaphorcreations","product":"Ditty","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ditty-news-ticker","versions":[{"version":"n/a","lessThanOrEqual":"3.1.69","versionType":"custom","status":"affected","changes":[{"at":"3.1.70","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:44:29.133859Z","id":"CVE-2026-94461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ditty-news-ticker/vulnerability/wordpress-ditty-plugin-3-1-69-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94487","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:49.540","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PublishPress","product":"PublishPress Capabilities","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"capability-manager-enhanced","versions":[{"version":"n/a","lessThanOrEqual":"2.50.1","versionType":"custom","status":"affected","changes":[{"at":"2.51.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:17.655789Z","id":"CVE-2026-94487","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-50-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94498","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:49.790","lastModified":"2026-09-23T20:17:24.153","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"AppMySite","product":"AppMySite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"appmysite","versions":[{"version":"n/a","lessThanOrEqual":"3.15.4","versionType":"custom","status":"affected","changes":[{"at":"3.15.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:25:47.272723Z","id":"CVE-2026-94498","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/appmysite/vulnerability/wordpress-appmysite-plugin-3-15-4-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94500","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:49.937","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Roxnor","product":"ElementsKit Elementor addons Lite","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"elementskit-lite","versions":[{"version":"n/a","lessThanOrEqual":"4.0.5","versionType":"custom","status":"affected","changes":[{"at":"4.0.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:14.282203Z","id":"CVE-2026-94500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/elementskit-lite/vulnerability/wordpress-elementskit-elementor-addons-lite-plugin-4-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94671","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:50.203","lastModified":"2026-09-23T20:17:24.260","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"RadiusTheme","product":"The Post Grid","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"the-post-grid","versions":[{"version":"n/a","lessThanOrEqual":"7.9.5","versionType":"custom","status":"affected","changes":[{"at":"7.9.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:04:55.286443Z","id":"CVE-2026-94671","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/the-post-grid/vulnerability/wordpress-the-post-grid-plugin-7-9-5-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94679","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:50.370","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WPManageNinja","product":"Fluent Support","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"fluent-support","versions":[{"version":"n/a","lessThanOrEqual":"2.3.2","versionType":"custom","status":"affected","changes":[{"at":"2.4.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:40:16.787554Z","id":"CVE-2026-94679","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/fluent-support/vulnerability/wordpress-fluent-support-plugin-2-3-2-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94680","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:50.517","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"RadiusTheme","product":"The Post Grid","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"the-post-grid","versions":[{"version":"n/a","lessThanOrEqual":"7.9.5","versionType":"custom","status":"affected","changes":[{"at":"7.9.6","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:37:54.215904Z","id":"CVE-2026-94680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/the-post-grid/vulnerability/wordpress-the-post-grid-plugin-7-9-5-cross-site-scripting-xss-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94682","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:50.660","lastModified":"2026-09-23T20:17:24.373","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"SecondLineThemes","product":"Podcast Importer SecondLine","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"podcast-importer-secondline","versions":[{"version":"n/a","lessThanOrEqual":"1.5.6","versionType":"custom","status":"affected","changes":[{"at":"1.5.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:26:03.385582Z","id":"CVE-2026-94682","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/podcast-importer-secondline/vulnerability/wordpress-podcast-importer-secondline-plugin-1-5-6-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-94684","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:50.790","lastModified":"2026-10-01T10:17:17.537","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-95513","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:50.933","lastModified":"2026-09-23T20:17:24.483","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"vcita","product":"Online Booking & Scheduling Calendar for WordPress by vcita","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"meeting-scheduler-by-vcita","versions":[{"version":"n/a","lessThanOrEqual":"4.6.0","versionType":"custom","status":"affected","changes":[{"at":"4.6.3","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:06:10.530489Z","id":"CVE-2026-95513","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/meeting-scheduler-by-vcita/vulnerability/wordpress-online-booking-scheduling-calendar-for-wordpress-by-vcita-plugin-4-6-0-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95514","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:51.083","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"netgsm","product":"Netgsm","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"netgsm","versions":[{"version":"n/a","lessThanOrEqual":"2.10.0","versionType":"custom","status":"affected","changes":[{"at":"2.10.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:37:53.280272Z","id":"CVE-2026-95514","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-289"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/netgsm/vulnerability/wordpress-netgsm-plugin-2-10-0-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95515","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:51.250","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Kevin Stover","product":"Ninja Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ninja-forms","versions":[{"version":"n/a","lessThanOrEqual":"3.15.3","versionType":"custom","status":"affected","changes":[{"at":"3.15.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:38:00.739381Z","id":"CVE-2026-95515","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ninja-forms/vulnerability/wordpress-ninja-forms-plugin-3-15-3-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95522","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:51.393","lastModified":"2026-09-23T20:17:24.593","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Syed Balkhi","product":"Easy Digital Downloads","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"easy-digital-downloads","versions":[{"version":"n/a","lessThanOrEqual":"3.7.0","versionType":"custom","status":"affected","changes":[{"at":"3.7.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:26:18.957325Z","id":"CVE-2026-95522","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/easy-digital-downloads/vulnerability/wordpress-easy-digital-downloads-plugin-3-7-0-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95523","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:51.527","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP User Frontend","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-frontend","versions":[{"version":"n/a","lessThanOrEqual":"4.3.11","versionType":"custom","status":"affected","changes":[{"at":"4.3.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:37:05.428105Z","id":"CVE-2026-95523","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-11-bypass-vulnerability-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95524","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:51.670","lastModified":"2026-09-23T20:17:24.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP User Frontend","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-frontend","versions":[{"version":"n/a","lessThanOrEqual":"4.3.11","versionType":"custom","status":"affected","changes":[{"at":"4.3.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:06:07.986501Z","id":"CVE-2026-95524","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-11-bypass-vulnerability-vulnerability-2?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95525","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:51.813","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"weDevs","product":"WP User Frontend","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"wp-user-frontend","versions":[{"version":"n/a","lessThanOrEqual":"4.3.11","versionType":"custom","status":"affected","changes":[{"at":"4.3.12","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:35:53.639398Z","id":"CVE-2026-95525","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-user-frontend/vulnerability/wordpress-wp-user-frontend-plugin-4-3-11-arbitrary-file-deletion-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95527","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:51.967","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Conekta Group","product":"Conekta Payment Gateway","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"conekta-payment-gateway","versions":[{"version":"n/a","lessThanOrEqual":"6.2.4","versionType":"custom","status":"affected","changes":[{"at":"6.2.5","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:36:58.773320Z","id":"CVE-2026-95527","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/conekta-payment-gateway/vulnerability/wordpress-conekta-payment-gateway-plugin-6-2-4-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95528","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:52.107","lastModified":"2026-09-23T20:17:24.843","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Mohammed Kaludi","product":"Core Web Vitals & PageSpeed Booster","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"core-web-vitals-pagespeed-booster","versions":[{"version":"n/a","lessThanOrEqual":"1.0.31","versionType":"custom","status":"affected","changes":[{"at":"1.0.32","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:26:32.686705Z","id":"CVE-2026-95528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/core-web-vitals-pagespeed-booster/vulnerability/wordpress-core-web-vitals-pagespeed-booster-plugin-1-0-31-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95529","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:52.237","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"codepeople","product":"Calculated Fields Form","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"calculated-fields-form","versions":[{"version":"n/a","lessThanOrEqual":"5.5.1.1","versionType":"custom","status":"affected","changes":[{"at":"5.5.1.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:36:48.865963Z","id":"CVE-2026-95529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/calculated-fields-form/vulnerability/wordpress-calculated-fields-form-plugin-5-5-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95530","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:52.377","lastModified":"2026-09-23T20:17:24.970","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"PixelYourSite","product":"PixelYourSite – Your smart PIXEL (TAG) Manager","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"pixelyoursite","versions":[{"version":"n/a","lessThanOrEqual":"11.4.1","versionType":"custom","status":"affected","changes":[{"at":"11.4.2","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:04:53.445107Z","id":"CVE-2026-95530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/pixelyoursite/vulnerability/wordpress-pixelyoursite-your-smart-pixel-tag-manager-plugin-11-4-1-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95586","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:52.513","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Themefic","product":"Ultimate Addons for Contact Form 7","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ultimate-addons-for-contact-form-7","versions":[{"version":"n/a","lessThanOrEqual":"3.5.50","versionType":"custom","status":"affected","changes":[{"at":"3.5.51","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:34:10.241092Z","id":"CVE-2026-95586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultimate-addons-for-contact-form-7-plugin-3-5-50-cross-site-scripting-xss-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95590","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:52.653","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Subscriber SQL Injection in Tainacan <= 1.2.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"tainacan","product":"Tainacan","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"tainacan","versions":[{"version":"n/a","lessThanOrEqual":"1.2.0","versionType":"custom","status":"affected","changes":[{"at":"1.3.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:36:52.598882Z","id":"CVE-2026-95590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tainacan/vulnerability/wordpress-tainacan-plugin-1-2-0-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95592","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:52.800","lastModified":"2026-09-23T20:17:25.120","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Oleh RadiusTheme","product":"Team","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"tlp-team","versions":[{"version":"n/a","lessThanOrEqual":"6.0.0","versionType":"custom","status":"affected","changes":[{"at":"6.0.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:26:47.981339Z","id":"CVE-2026-95592","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tlp-team/vulnerability/wordpress-team-plugin-6-0-0-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95593","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:52.933","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Editor SQL Injection in Ultimeter <= 3.0.8 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Ben Roberts","product":"Ultimeter","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"ultimeter","versions":[{"version":"n/a","lessThanOrEqual":"3.0.8","versionType":"custom","status":"affected","changes":[{"at":"3.1.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:36:41.354566Z","id":"CVE-2026-95593","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/ultimeter/vulnerability/wordpress-ultimeter-plugin-3-0-8-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95600","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:53.073","lastModified":"2026-09-23T20:17:25.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"TrustedLogin","product":"TrustedLogin Connector","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"trustedlogin-connector","versions":[{"version":"n/a","lessThanOrEqual":"2.0.3","versionType":"custom","status":"affected","changes":[{"at":"2.0.4","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:06:05.682582Z","id":"CVE-2026-95600","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/trustedlogin-connector/vulnerability/wordpress-trustedlogin-connector-plugin-2-0-3-sensitive-data-exposure-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95601","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:53.210","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"WBW Plugins","product":"Product Filter by WBW","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"woo-product-filter","versions":[{"version":"n/a","lessThanOrEqual":"3.1.7","versionType":"custom","status":"affected","changes":[{"at":"3.1.8","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:23:43.252403Z","id":"CVE-2026-95601","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/woo-product-filter/vulnerability/wordpress-product-filter-by-wbw-plugin-3-1-7-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95602","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:53.350","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"YITH","product":"YITH WooCommerce Request A Quote","defaultStatus":"unaffected","versions":[{"version":"n/a","lessThan":"4.46.1","versionType":"custom","status":"affected","changes":[{"at":"4.46.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:36:36.299205Z","id":"CVE-2026-95602","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/yith-woocommerce-request-a-quote/vulnerability/wordpress-yith-woocommerce-request-a-quote-plugin-4-46-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95603","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:53.500","lastModified":"2026-09-23T20:17:25.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Victor Rodriguez","product":"Reycob Product Import Export","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"reycob-product-import-export","versions":[{"version":"n/a","lessThanOrEqual":"2.3.0","versionType":"custom","status":"affected","changes":[{"at":"2.4.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:27:03.351380Z","id":"CVE-2026-95603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/reycob-product-import-export/vulnerability/wordpress-reycob-product-import-export-plugin-2-3-0-php-object-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-95604","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T19:19:53.637","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Tangible","product":"Loops & Logic","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"tangible-loops-and-logic","versions":[{"version":"n/a","lessThanOrEqual":"4.2.4","versionType":"custom","status":"affected","changes":[{"at":"4.3.0","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:36:30.159320Z","id":"CVE-2026-95604","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tangible-loops-and-logic/vulnerability/wordpress-loops-logic-plugin-4-2-4-broken-access-control-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96541","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:54.080","lastModified":"2026-10-14T04:19:01.200","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global connection limit, an attacker can prevent new RDP clients from connecting until a holding socket is closed."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gnome-remote-desktop","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gnome-remote-desktop","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gnome-remote-desktop","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-13T00:00:00+00:00","id":"CVE-2026-96541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96541","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539385","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/356","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/356","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96545","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:54.227","lastModified":"2026-09-24T14:51:56.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp:2.8/gimp","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:30:36.492172Z","id":"CVE-2026-96545","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96545","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539597","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16791","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16791","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96546","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T19:19:54.373","lastModified":"2026-09-25T18:17:34.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp:2.8/gimp","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","baseScore":2.5,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.0,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:55:56.846466Z","id":"CVE-2026-96546","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96546","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539601","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16802","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16802","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96548","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T19:19:54.513","lastModified":"2026-09-23T19:39:08.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"sfturing","product":"hosp_order","cpes":["cpe:2.3:a:sfturing:hosp_order:*:*:*:*:*:*:*:*"],"versions":[{"version":"627f426331da8086ce8fff2017d65b1ddef384f8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:P","baseScore":5.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":4.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:43:56.129603Z","id":"CVE-2026-96548","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-259"},{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://github.com/sfturing/hosp_order/","source":"cna@vuldb.com"},{"url":"https://github.com/sfturing/hosp_order/issues/119","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96548","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907904","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408950","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408950/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96549","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T19:19:54.703","lastModified":"2026-09-23T20:17:26.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"sfturing","product":"hosp_order","cpes":["cpe:2.3:a:sfturing:hosp_order:*:*:*:*:*:*:*:*"],"versions":[{"version":"627f426331da8086ce8fff2017d65b1ddef384f8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:P/I:N/A:N","baseScore":1.7,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.1,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:26:57.905120Z","id":"CVE-2026-96549","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-310"},{"lang":"en","value":"CWE-312"}]}],"references":[{"url":"https://github.com/sfturing/hosp_order/","source":"cna@vuldb.com"},{"url":"https://github.com/sfturing/hosp_order/issues/120","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96549","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907905","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408951","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408951/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96770","sourceIdentifier":"security@temporal.io","published":"2026-09-23T19:19:55.013","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required."}],"affected":[{"source":"security@temporal.io","affectedData":[{"vendor":"Temporal Technologies, Inc.","product":"s2s-proxy","defaultStatus":"unaffected","collectionURL":"https://pkg.go.dev","packageName":"github.com/temporalio/s2s-proxy","programFiles":["encryption/tls.go"],"programRoutines":[{"name":"GetServerTLSConfig"}],"repo":"https://github.com/temporalio/s2s-proxy","versions":[{"version":"0.0.1-alpha","lessThanOrEqual":"0.2.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@temporal.io","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:36:07.279659Z","id":"CVE-2026-96770","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@temporal.io","type":"Secondary","description":[{"lang":"en","value":"CWE-296"}]}],"references":[{"url":"https://docs.temporal.io/production-deployment/data-encryption#codec-server-setup","source":"security@temporal.io"},{"url":"https://github.com/temporalio/s2s-proxy/blob/v0.2.2/encryption/tls.go#L47-L62","source":"security@temporal.io"},{"url":"https://github.com/temporalio/s2s-proxy/commit/d100c2258dbc37d7df51298ea045315f36c7eb3b","source":"security@temporal.io"},{"url":"https://github.com/temporalio/s2s-proxy/commit/f1dc6b9a3919d37e82545ab461cbe6bb62618d3c","source":"security@temporal.io"},{"url":"https://github.com/temporalio/s2s-proxy/pull/296","source":"security@temporal.io"}]}},{"cve":{"id":"CVE-2026-96872","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-23T19:19:55.327","lastModified":"2026-09-24T20:02:50.260","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects Mediawiki - WikiLambda Extension: before 1.47.0."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - WikiLambda Extension","defaultStatus":"unaffected","platforms":["Linux","MacOS","Windows"],"repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/WikiLambda","versions":[{"version":"0","lessThan":"1.47.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:34:57.995525Z","id":"CVE-2026-96872","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-280"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikiLambda/+/1326392","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435085","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-66070","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:12.850","lastModified":"2026-10-19T20:36:27.797","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard \"\" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = \"\"), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = \"*\", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.17","status":"affected"},{"version":">= 4.0.0, < 4.0.22","status":"affected"},{"version":">= 4.1.0, < 4.1.13","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:16:50.638390Z","id":"CVE-2026-66070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-942"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.17","matchCriteriaId":"2998A885-A956-406D-BD6F-856FF52B72D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.22","matchCriteriaId":"F9CF5E9C-1315-47E2-B3FB-27A066E256F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.13","matchCriteriaId":"F446F1B9-F655-4C12-AF39-2E9BC0468DD9"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p3hp-v9wh-ghm7","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-66076","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:13.007","lastModified":"2026-10-19T20:36:35.243","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost from the path without checking that the user can access it. Any management-tagged user can therefore read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible vhosts, exposing cross-tenant queue names and cluster topology. The management plugin must be enabled and the attacker must have a management tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:31:07.323976Z","id":"CVE-2026-66076","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j45q-v7g2-82ph","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-j45q-v7g2-82ph","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-66079","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:13.150","lastModified":"2026-10-19T20:36:50.350","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:12:28.546356Z","id":"CVE-2026-66079","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67238","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:13.297","lastModified":"2026-09-24T16:17:09.780","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.7","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:59.018268Z","id":"CVE-2026-67238","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-68490","sourceIdentifier":"support@hackerone.com","published":"2026-09-23T20:17:13.447","lastModified":"2026-09-24T21:16:28.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"WebPros","product":"cPanel","versions":[{"version":"11.120.0.0","lessThan":"11.134.0.57","versionType":"semver","status":"affected"},{"version":"11.136.0.0","lessThan":"11.136.0.41","versionType":"semver","status":"affected"},{"version":"11.138.0.0","lessThan":"11.138.0.8","versionType":"semver","status":"affected"},{"version":"11.134.0.57","lessThan":"11.134.0.57","versionType":"semver","status":"unaffected"},{"version":"11.136.0.41","lessThan":"11.136.0.41","versionType":"semver","status":"unaffected"},{"version":"11.138.0.8","lessThan":"11.138.0.8","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:28:48.363650Z","id":"CVE-2026-68490","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://support.cpanel.net/hc/en-us/articles/43502940099991","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-68492","sourceIdentifier":"support@hackerone.com","published":"2026-09-23T20:17:13.583","lastModified":"2026-09-24T21:16:28.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the \"Plesk RESTful API\" extension from 2.4.2 before 2.4.7."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"WebPros","product":"Plesk","defaultStatus":"unaffected","versions":[{"version":"18.0.34","lessThan":"18.0.80.8","versionType":"semver","status":"affected"},{"version":"18.0.81","lessThan":"18.0.81.1","versionType":"semver","status":"affected"}]},{"vendor":"WebPros","product":"Plesk extension \"Plesk RESTful API\"","defaultStatus":"unaffected","versions":[{"version":"2.4.2","lessThan":"2.4.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:28:28.100954Z","id":"CVE-2026-68492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-426"}]}],"references":[{"url":"https://support.plesk.com/hc/en-us/articles/43644058632983","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-75884","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:14.637","lastModified":"2026-09-24T16:17:10.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"],"versions":[{"version":"0:4.5.36-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"],"versions":[{"version":"0:4.5.36-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:03:21.427356Z","id":"CVE-2026-75884","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71115","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-75884","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517893","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-82405","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:16.370","lastModified":"2026-09-24T16:17:12.153","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An attacker-controlled contract can choose a victim account with configured permissions as RecipientAddr, and contractHasValidPermission can accept the victim's default self-signer as authorization. UpdatePermission can then replace the victim's entire permission set with attacker-supplied Owner permissions, enabling asset theft or permanent lockout without a victim key or signature. Accounts without stored permissions and the native transaction path are not affected. This issue is fixed in version 1.7.20."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"klever-io","product":"klever-go","versions":[{"version":"< 1.7.20","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:03:22.911530Z","id":"CVE-2026-82405","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://gist.github.com/mabdullah22/a41f90aa5ba86bbebf121f739bd5f5e9","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/commit/c58740eb74d7ee8f07db1e18a7d6214b5559ba32","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/releases/tag/v1.7.20","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-97cv-x867-6xhm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-82406","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:16.547","lastModified":"2026-09-24T16:17:12.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the claimed order loadable with a future EndTime and stale CurrentBid and CurrentBidder values. A later bidder can submit a higher bid, be debited, and cause the previous bidder to receive a refund even though the NFT has already been delivered. Because Claim and CancelOrder reject the later bidder when IsClaimed is true, the later bidder cannot obtain the NFT or recover the funds. This issue is fixed in version 1.7.20."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"klever-io","product":"klever-go","versions":[{"version":"< 1.7.20","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:20:43.702470Z","id":"CVE-2026-82406","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-841"}]}],"references":[{"url":"https://github.com/klever-io/klever-go/commit/063bb3ed98f9a84a4b1f7286680613a5fc3c91b2","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/pull/16","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/releases/tag/v1.7.20","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-26r5-4mm2-px5c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-82407","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:16.707","lastModified":"2026-09-23T20:17:16.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed key becomes eligible and is selected into a consensus group, MultiSigner.Reset and the corresponding signature verification creation path cannot deserialize the group key and cancel the slot. This causes repeated missed rounds and throughput degradation, and a network whose consensus group equals the eligible validator set can halt completely. Genesis validation is not affected because that path already performs CheckPublicKeyValid. This issue is fixed in version 1.7.20."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"klever-io","product":"klever-go","versions":[{"version":"< 1.7.20","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:41:57.322149Z","id":"CVE-2026-82407","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/klever-io/klever-go/commit/11606a90ccc289f93d0175994733229b332d9cff","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/commit/642da967893884d635986fed3c43bdc679cbfe8f","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/releases/tag/v1.7.20","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-9wh6-9hq7-9688","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-82409","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:16.893","lastModified":"2026-09-24T16:17:12.420","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"klever-io","product":"klever-go","versions":[{"version":"< 1.7.20","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:22:05.678124Z","id":"CVE-2026-82409","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/releases/tag/v1.7.20","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-84683","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:17.403","lastModified":"2026-09-25T18:17:30.990","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The HTML view of job, ad hoc command, project update, and inventory\nupdate standard output escapes HTML metacharacters but does not remove ANSI\nterminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink\nsequence in the output is expanded into an HTML anchor whose href is not scheme-\nfiltered or escaped, so a low-privileged user who can produce output -- or an\nexternal party whose data a playbook echoes -- can embed a javascript: link that\nis rendered into a text/html response with no Content-Security-Policy. When a\nhigher-privileged user views the output page and clicks the link, attacker-\ncontrolled JavaScript executes in their authenticated session, allowing actions\nas that user up to full platform takeover."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:49:39.046423Z","id":"CVE-2026-84683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84683","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527128","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84691","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:17.537","lastModified":"2026-09-24T14:51:56.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Red Hat Ansible Automation Platform's automation-\ncontroller. The setting that formats the log message emitted for API 4XX errors\nis an administrator-controlled Python format-string template that is rendered\nwith a live user object as an argument. Because Python string formatting permits\nattribute and item traversal on its arguments, an administrator can craft a\ntemplate that walks from the user object into the application settings and reads\nthe Django secret key and the database password. The formatted message is written\nto a logger that can be forwarded to an external log aggregator, whose destination\nis also administrator-controlled, allowing the secrets to be sent off the host. An\nauthenticated administrator can thereby obtain the master encryption key used to\nprotect all stored credentials and the database service password, enabling offline\ndecryption of every stored credential, forgery of user sessions, and direct\naccess to the controller database."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-84691","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-134"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84691","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527151","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84706","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:17.677","lastModified":"2026-09-26T23:16:37.817","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in Ansible Automation Platform's automation-controller. The custom\nCredential Type environment-variable injector validates variable names against a\ndeny-list (an ANSIBLE_* prefix check plus a fixed ENV_BLOCKLIST) that omits\nprocess-hijacking loader variables such as BASH_ENV, ENV, LD_PRELOAD, LD_LIBRARY_PATH,\nPYTHONSTARTUP and GIT_SSH_COMMAND. Combined with the credential file injector, a\nprivileged user can write an attacker-controlled script into the execution environment\nand point BASH_ENV at it, obtaining arbitrary code execution inside the\nexecution-environment container for any job that attaches a credential of that type."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:46:28.126286Z","id":"CVE-2026-84706","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84706","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527187","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84712","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:17.817","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the automation-controller API. The\n                  unauthenticated health-check endpoint /api/v2/ping/\n                  (ApiV2PingView, AllowAny) over-serializes RBAC-gated\n                  automation-mesh data into its anonymous response, exposing the\n                  full instance inventory (node hostnames, node types, UUIDs,\n                  heartbeats, capacities, and exact versions), all instance-group\n                  names and membership, the deployment install UUID, and the\n                  active control node. A remote, unauthenticated attacker can use\n                  this to map the control plane and fingerprint software versions\n                  for targeted attacks. This flaw affects confidentiality only;\n                  it does not expose secrets, credentials, or tenant data."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:29:05.289631Z","id":"CVE-2026-84712","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84712","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527196","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84713","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:17.950","lastModified":"2026-10-16T12:16:41.330","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the automation-controller notification\n                  subsystem. Although NotificationTemplate.notification_\n                  configuration is protected from API filtering, its recipient\n                  value is copied in clear text into the unprotected\n                  Notification.recipients field on every send. Because the\n                  credential-types endpoint is listable by any authenticated\n                  user and the API filter backend traverses object relations\n                  without per-hop authorization, a user with no privileges can\n                  use a relational filter as a boolean count-oracle to recover,\n                  character by character and across organizations, the secret\n                  recipient values of other tenants' notifications — including\n                  PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook\n                  bearer-token URLs. This flaw affects confidentiality."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:51:10.536280Z","id":"CVE-2026-84713","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84713","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527197","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84714","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:18.083","lastModified":"2026-09-24T15:17:44.810","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the automation-controller input-validation\n                  guard sanitize_jinja(). The function uses two regular\n                  expressions to reject user-supplied Jinja, but the patterns\n                  stop at the first interior '}' or '%' character, so a Jinja\n                  expression containing an inner brace (for example an empty\n                  dict) is accepted while remaining valid Jinja. Because\n                  sanitize_jinja() is the sole guard on several launch-time\n                  fields — ad-hoc command module_args, Machine-credential\n                  username / become_method / become_user, and inventory host\n                  names — a low-privileged user can inject Jinja that ansible-core\n                  evaluates in the execution environment. This enables execution\n                  of arbitrary commands in the execution environment (bypassing an\n                  administrator's AD_HOC_COMMANDS module allowlist) and disclosure\n                  of secrets belonging to credentials the attacker cannot read\n                  (by templating a co-attached credential's injected environment\n                  variables), across the credential access-control boundary."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:30:29.078484Z","id":"CVE-2026-84714","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84714","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527198","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84716","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:18.210","lastModified":"2026-09-24T16:17:12.540","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the automation-controller instance\n                  install-bundle endpoint. When a System Administrator downloads\n                  an execution/hop node's install bundle, the controller signs an\n                  X.509 certificate with the receptor mesh certificate authority\n                  in which the Common Name, DNS subject-alternative-name, and\n                  receptor node-id are taken verbatim from the caller-chosen\n                  instance hostname, with a hard-coded ten-year validity, a random\n                  serial, and no issuance log or revocation list. Because the\n                  hostname charset validator is case-insensitive while the\n                  uniqueness validator is case-sensitive, an administrator can\n                  register a case variant of an existing control node's hostname\n                  and obtain a mesh-CA-signed certificate that TLS peers, which\n                  match hostnames case-insensitively, accept as that control node.\n                  In managed/hosted deployments — where the customer holds\n                  controller superuser but the platform operator runs the mesh —\n                  this yields a long-lived, non-revocable mesh peer credential and,\n                  with an on-path position, TLS impersonation or interception of\n                  control/hybrid mesh nodes. It does not grant direct remote code\n                  execution, because receptor work submission is gated by a\n                  separate signing key not included in the bundle."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:59:02.127273Z","id":"CVE-2026-84716","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84716","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527199","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84717","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:18.353","lastModified":"2026-09-26T23:16:37.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated\nBitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping\nevents after it has already looked up the target template, causing the endpoint to return HTTP\n200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An\nunauthenticated remote attacker can use this response discrepancy as an oracle to enumerate\nwhich Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without\nknowing the secret webhook_key."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:46:38.467434Z","id":"CVE-2026-84717","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-204"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84717","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527210","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84718","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:18.487","lastModified":"2026-09-24T15:17:45.033","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Ansible Automation Platform automation-controller. In the shipped\nproduction configuration, the Controller trusts the client-supplied X-Forwarded-For header as\nthe request's client IP without verifying that it originated from a trusted proxy, and selects\nthe leftmost (attacker-controlled) header value. As a result, an attacker can forge the source\nIP address recorded for their requests in the Controller's audit and access logs, degrading\nthe integrity of forensic and SIEM attribution. The flaw does not grant additional access."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:18:44.214387Z","id":"CVE-2026-84718","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84718","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527211","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84719","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:18.617","lastModified":"2026-09-25T19:17:58.367","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Ansible Automation Platform automation-controller. When a\nWorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory,\nunified_job_template, and credentials of each cloned node and fails to check the instance_groups\n(and execution_environment and labels) that were preserved from the original. A user with\norganization workflow-admin permission but no role on the referenced instance groups can copy a\nworkflow, become its administrator, and launch jobs pinned to instance groups they are not\nauthorized to use — including the control-plane instance group — bypassing the InstanceGroup\nuse_role boundary and causing attacker-influenced automation to run in the control-plane\nexecution context."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"],"versions":[{"version":"0:4.5.36-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.4 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.4::el8","cpe:/a:redhat:ansible_automation_platform:2.4::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.4::el9"],"versions":[{"version":"0:4.5.36-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:12:24.241646Z","id":"CVE-2026-84719","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71115","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84719","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527213","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84720","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:18.753","lastModified":"2026-09-24T15:17:45.170","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Ansible Automation Platform automation-controller. The\nWorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats\nartifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore\naccepted for arbitrary field lookups by the REST filter backend, even though it is omitted from\nthe API serializer. Because the column is persisted before Ansible's no_log masking is applied,\na user with only read access to a workflow — or, via a regular-expression lookup that bypasses\nthe JSON cross-relation filter guard through the world-readable credential-types endpoint, any\nauthenticated user with no roles — can use the result count as a boolean/count oracle to recover,\ncharacter by character, secret values that a playbook author explicitly marked no_log, including\nacross organizations."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:30:07.780697Z","id":"CVE-2026-84720","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84720","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527214","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84721","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:18.890","lastModified":"2026-10-16T12:16:41.870","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A server-side request forgery flaw was found in the Ansible Automation Platform\nautomation-controller email notification backend. The email backend passes the user-supplied SMTP\nhost and port from a notification template directly to the SMTP client without validating that\nthe target is not an internal, loopback, link-local, or reserved address. An authenticated user\nwith organization notification-admin permission can create or modify an email notification\ntemplate pointing at an arbitrary internal address, trigger a test, and have the controller task\nprocess open a raw TCP connection to that address. The resulting connection error is reflected\nback through the notification record, providing a three-state internal port-scan oracle (open,\nclosed, filtered) over the control-plane's cluster network, including the in-cluster Kubernetes\nAPI. When a shared organization template holds a stored SMTP password, redirecting the host can\nalso cause that credential to be transmitted to an attacker-controlled server."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:59:00.476952Z","id":"CVE-2026-84721","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84721","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527220","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-84724","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:19.033","lastModified":"2026-09-26T23:16:38.090","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An argument-injection flaw was found in the Ansible Automation Platform automation-controller\nsystem-job subsystem. The system-job template launch endpoint stores a user-supplied \"days\"\nvariable without running the integer validation defined elsewhere for that field, and the\ndispatcher flattens the management-command argument list into a single string with spaces before\nthe job runner re-splits it, so spaces in the value become additional command-line arguments.\nBecause system jobs are executed in-process on the control node without the container isolation\napplied to all other job types, an authenticated user with superuser privileges can inject\narbitrary arguments — including Python's path option — into the control-plane awx-manage process,\ncontrolling its argument vector and the first entry of its module search path. Full remote code\nexecution requires an additional import gadget that is not present in the current management\ncommands, so the demonstrated impact is argument injection with control of the process search\npath rather than confirmed code execution."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el8ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"],"versions":[{"version":"0:4.6.33-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:4.7.17-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1789673739","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:46:52.225556Z","id":"CVE-2026-84724","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84724","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527222","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-85475","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:19.343","lastModified":"2026-10-16T12:16:42.060","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Ansible Automation Platform automation controller. The\nexternal logging (rsyslog) configuration is generated by interpolating\nuser-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH\nand LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config\nfile without neutralizing RainerScript syntax. A privileged (superuser) user can\ninject rsyslog directives, including an omprog action, causing arbitrary command\nexecution inside the control-plane rsyslog component. This allows disclosure of\nthe controller SECRET_KEY and database credentials, decryption of all stored\ncredentials, and full compromise of the control plane."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1789580684","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/controller-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-controller","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:33:34.362171Z","id":"CVE-2026-85475","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-96"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71177","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85475","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2528255","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-86064","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:19.960","lastModified":"2026-09-23T20:17:20.117","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in network/api/logs/logSender.go and applied process-wide through Profile.Apply, allowing a remote client to change global log levels and formatting options until the connection closes. The same connection is registered as a log observer and can receive live process logs. An attacker can suppress normal logs, increase verbosity, distort operator visibility, and access operational information without credentials. This issue is fixed in version 1.7.20."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"klever-io","product":"klever-go","versions":[{"version":"< 1.7.20","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:29:16.068653Z","id":"CVE-2026-86064","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/klever-io/klever-go/commit/a2740c985a788fb69e17742ea4f0c37c440733b2","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/pull/74","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/releases/tag/v1.7.20","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-9v8p-frvj-2pcm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-86065","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T20:17:20.160","lastModified":"2026-09-29T03:17:18.780","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"klever-io","product":"klever-go","versions":[{"version":"< 1.7.20","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:10:04.993031Z","id":"CVE-2026-86065","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/klever-io/klever-go/commit/b8af922e749ec1fa7451b2c6e7c9f634d8603be2","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/pull/76","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/releases/tag/v1.7.20","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm","source":"security-advisories@github.com"},{"url":"https://github.com/klever-io/klever-go/security/advisories/GHSA-4fwh-wrm6-97xm","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-87898","sourceIdentifier":"support@hackerone.com","published":"2026-09-23T20:17:20.340","lastModified":"2026-09-24T21:16:28.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"WebPros","product":"Plesk extension \"Site Import\"","versions":[{"version":"1.6.6","lessThanOrEqual":"1.12.1","versionType":"semver","status":"affected"},{"version":"1.12.2","lessThan":"1.12.2","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T20:06:19.972843Z","id":"CVE-2026-87898","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://support.plesk.com/hc/en-us/articles/43641151026583","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-87899","sourceIdentifier":"support@hackerone.com","published":"2026-09-23T20:17:20.480","lastModified":"2026-09-24T21:16:28.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"WebPros","product":"cPanel","versions":[{"version":"11.120.0.0","lessThan":"11.134.0.57","versionType":"semver","status":"affected"},{"version":"11.136.0.0","lessThan":"11.136.0.41","versionType":"semver","status":"affected"},{"version":"11.138.0.0","lessThan":"11.138.0.8","versionType":"semver","status":"affected"},{"version":"11.134.0.57","lessThan":"11.134.0.57","versionType":"semver","status":"unaffected"},{"version":"11.136.0.41","lessThan":"11.136.0.41","versionType":"semver","status":"unaffected"},{"version":"11.138.0.8","lessThan":"11.138.0.8","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-87899","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://support.cpanel.net/hc/en-us/articles/43591715125271","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-87900","sourceIdentifier":"support@hackerone.com","published":"2026-09-23T20:17:20.613","lastModified":"2026-09-24T21:16:28.120","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts."}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"WebPros","product":"WP Toolkit for cPanel","versions":[{"version":"0","lessThanOrEqual":"6.11.2-10794","versionType":"semver","status":"affected"},{"version":"6.11.3-10850","lessThan":"6.11.3-10850","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T20:05:51.395539Z","id":"CVE-2026-87900","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-88"}]}],"references":[{"url":"https://support.cpanel.net/hc/en-us/articles/43597969409943","source":"support@hackerone.com"}]}},{"cve":{"id":"CVE-2026-94183","sourceIdentifier":"59469e6c-7ea7-446f-8e43-06aa32c115e8","published":"2026-09-23T20:17:23.907","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Arc Search for Android before version 1.12.10 does not display a fullscreen notification when a page enters fullscreen mode while the app is running in the background. A remote attacker can exploit this via a specially crafted website to render fake UI elements, such as a spoofed address bar, misleading the user about the origin of displayed content and increasing the risk of phishing."}],"affected":[{"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","affectedData":[{"vendor":"The Browser Company of New York","product":"Arc Search","defaultStatus":"unaffected","platforms":["Android"],"versions":[{"version":"0","lessThan":"1.12.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T19:31:42.640596Z","id":"CVE-2026-94183","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"59469e6c-7ea7-446f-8e43-06aa32c115e8","type":"Secondary","description":[{"lang":"en","value":"CWE-451"}]}],"references":[{"url":"https://arc.net/security/bulletins#cve-2026-94183-address-bar-spoof-risk-missing-fullscreen-notification-on-return-from-background","source":"59469e6c-7ea7-446f-8e43-06aa32c115e8"},{"url":"https://hackerone.com/reports/3572193","source":"59469e6c-7ea7-446f-8e43-06aa32c115e8"}]}},{"cve":{"id":"CVE-2026-96550","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T20:17:26.350","lastModified":"2026-09-29T03:17:21.870","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_pro/src/main/java/cn/sfturing/utils/MailUtil.java. Performing a manipulation results in cleartext transmission of sensitive information. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is assessed as difficult. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"sfturing","product":"hosp_order","cpes":["cpe:2.3:a:sfturing:hosp_order:*:*:*:*:*:*:*:*"],"versions":[{"version":"627f426331da8086ce8fff2017d65b1ddef384f8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.9,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:N/A:N","baseScore":2.6,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":4.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:11:09.658129Z","id":"CVE-2026-96550","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-310"},{"lang":"en","value":"CWE-319"}]}],"references":[{"url":"https://github.com/sfturing/hosp_order/","source":"cna@vuldb.com"},{"url":"https://github.com/sfturing/hosp_order/issues/121","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96550","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907906","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408952","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408952/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96551","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T20:17:26.547","lastModified":"2026-09-24T15:18:00.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"sfturing","product":"hosp_order","cpes":["cpe:2.3:a:sfturing:hosp_order:*:*:*:*:*:*:*:*"],"versions":[{"version":"627f426331da8086ce8fff2017d65b1ddef384f8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:29:24.432938Z","id":"CVE-2026-96551","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/sfturing/hosp_order/","source":"cna@vuldb.com"},{"url":"https://github.com/sfturing/hosp_order/issues/122","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96551","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907907","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408953","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408953/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96552","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T20:17:26.737","lastModified":"2026-09-24T16:17:26.547","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function MD5.getMD5 of the file ssm_pro/src/main/java/cn/sfturing/utils/MD5.java of the component User Password Handler. The manipulation leads to one-way hash without salt. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is described as difficult. The exploit is publicly available and might be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"sfturing","product":"hosp_order","cpes":["cpe:2.3:a:sfturing:hosp_order:*:*:*:*:*:*:*:*"],"modules":["User Password Handler"],"versions":[{"version":"627f426331da8086ce8fff2017d65b1ddef384f8","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":1.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:H/Au:S/C:P/I:N/A:N","baseScore":2.1,"accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:45:29.848847Z","id":"CVE-2026-96552","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-325"},{"lang":"en","value":"CWE-759"}]}],"references":[{"url":"https://github.com/sfturing/hosp_order/","source":"cna@vuldb.com"},{"url":"https://github.com/sfturing/hosp_order/issues/123","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96552","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907955","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408954","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408954/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96826","sourceIdentifier":"audit@patchstack.com","published":"2026-09-23T20:17:27.333","lastModified":"2026-09-24T15:00:47.623","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allows Blind SQL Injection.\n\nThis issue affects W4 Post List: from n/a through 3.0.6."}],"affected":[{"source":"audit@patchstack.com","affectedData":[{"vendor":"Shazzad Hossain Khan","product":"W4 Post List","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","packageName":"w4-post-list","versions":[{"version":"n/a","lessThanOrEqual":"3.0.6","versionType":"custom","status":"affected","changes":[{"at":"3.0.7","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV31":[{"source":"audit@patchstack.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:41:56.285021Z","id":"CVE-2026-96826","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"audit@patchstack.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/w4-post-list/vulnerability/wordpress-w4-post-list-plugin-3-0-6-sql-injection-vulnerability?_s_id=cve","source":"audit@patchstack.com"}]}},{"cve":{"id":"CVE-2026-96889","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T20:17:27.587","lastModified":"2026-10-21T17:20:52.163","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the parser. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"glycin-loaders","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:1.0.1-1.el10_2.2","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"librsvg2","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:2.57.1-9.el10_2.10","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"librsvg2","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"versions":[{"version":"0:2.42.7-6.el8_10","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"librsvg2","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"versions":[{"version":"0:2.50.7-3.el9_8.1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"librsvg2","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"librsvg2","cpes":["cpe:/o:redhat:enterprise_linux:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:53:42.623078Z","id":"CVE-2026-96889","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:86331","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86841","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86842","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86921","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96889","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539279","source":"secalert@redhat.com"},{"url":"https://crates.io/crates/librsvg","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241","source":"secalert@redhat.com"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0305.html","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/librsvg/-/work_items/1241","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-53968","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T21:16:58.520","lastModified":"2026-10-16T14:10:00.120","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-53969","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T21:16:58.600","lastModified":"2026-10-16T14:10:00.120","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-53978","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T21:16:58.660","lastModified":"2026-10-16T14:10:00.120","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-53979","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T21:16:58.713","lastModified":"2026-10-16T14:10:00.120","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-66067","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:58.783","lastModified":"2026-09-24T15:02:58.307","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only check_vhost_access; it omits the node/vhost/user connection-limit checks that rabbit_reader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges the gap. No compensating enforcement exists in connection tracking or elsewhere in rabbitmq_stream. An authenticated tenant can fully bypass operator-configured per-user and per-vhost connection caps by connecting via port 5552 instead of 5672. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol credentials Operator relies on per-user/per-vhost connection limits for tenant isolation. This issue is fixed in versions 4.2.7 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.7","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:11:25.836720Z","id":"CVE-2026-66067","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-hwqx-2gfg-89qf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-66068","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:58.930","lastModified":"2026-10-19T20:36:59.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG(\"shutting down Shovel '~ts', ... Shovel state: ~tp\", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes. With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:56.147004Z","id":"CVE-2026-66068","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9wm4-9m6g-w38x","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-66069","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:59.073","lastModified":"2026-09-24T15:17:28.127","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (counters only, no log erasure), but inconsistent with rabbit_mgmt_wm_reset.erl which requires admin for the analogous operation. A monitoring-tagged user can reset the per-node authentication-attempt counters via DELETE /api/auth/attempts/:node, erasing evidence of brute-force activity. The sibling endpoint wm_reset requires administrator. Preconditions include Management plugin enabled monitoring tag. This issue is fixed in versions 4.1.13, 4.2.7, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.1.0, < 4.1.13","status":"affected"},{"version":">= 4.2.0, < 4.2.7","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:13:40.422428Z","id":"CVE-2026-66069","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-fhwq-9rvh-prj2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-66072","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:59.213","lastModified":"2026-10-19T20:37:05.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<\"chunk_selector\">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:27:03.236517Z","id":"CVE-2026-66072","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.1","matchCriteriaId":"41410FDE-4B5E-4466-B7C4-A62FEBFA0C80"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-48hm-chgv-398r","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-48hm-chgv-398r","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-66074","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:59.357","lastModified":"2026-10-19T20:37:21.697","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result set. OTP's default 10M match_limit caps each call at roughly 100-200ms, but the regex runs once per resource in the result set. With a large set, for example 5000 queues at 150ms each, a single request consumes 12 or more minutes of CPU. Parallel requests saturate the schedulers. The use_regex=true option is a supported feature on list endpoints, so this path is reachable through normal API use. Preconditions include Any user with the management tag can exploit this.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:50:12.470782Z","id":"CVE-2026-66074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rg5q-vcgf-rfh7","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-66075","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:59.500","lastModified":"2026-10-19T20:37:29.727","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_methods permits DELETE and delete_resource/2 triggers rabbit_federation_link_sup:restart. There is no per-method elevation check and no comment marking it intentional. A read-only monitoring user can restart any federation link , a state-changing operation that disrupts message flow. Preconditions include rabbitmq_federation + rabbitmq_federation_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:50:50.462399Z","id":"CVE-2026-66075","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.1","matchCriteriaId":"41410FDE-4B5E-4466-B7C4-A62FEBFA0C80"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-g5v3-w5xg-62q2","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-66077","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:59.647","lastModified":"2026-10-19T20:37:37.347","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_subject %> (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher's claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker's trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate's Subject DN. When any administrator views that connection in the management UI, the script executes in the admin's browser session, allowing full account takeover (create users, export definitions, etc.). The management UI's CSP includes 'unsafe-inline', so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or rabbitmq_trust_store plugin in use) Administrator views the connection detail page. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:14:04.707740Z","id":"CVE-2026-66077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rjcf-35r5-xw38","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-66080","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:59.787","lastModified":"2026-10-19T20:37:48.623","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB. Preconditions include The rabbitmq_stream_management plugin must be enabled. The caller needs the management tag and access to the target vhost.. This issue is fixed in versions 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:57.486603Z","id":"CVE-2026-66080","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wg79-5449-m728","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67218","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:16:59.930","lastModified":"2026-10-19T20:38:01.877","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept_content/2 at line 56 calls rabbit_stream_manager:create_super_stream/... directly after is_authorized (which only checks the management tag + vhost access via is_authorized_vhost). The stream-protocol equivalent (rabbit_stream_reader.erl create_super_stream handler) calls rabbit_stream_utils:check_super_stream_management_permitted/4 which enforces configure on the exchange and each partition queue. The HTTP handler omits this call entirely. A user with management tag and vhost access , but no configure permission on any resource , can create super-streams (an exchange + N partition stream queues + bindings) via the HTTP API. The native stream-protocol path enforces configure on each resource; the HTTP path does not, creating a privilege escalation from 'can view' to 'can create persistent cluster-wide resources.' Preconditions include rabbitmq_stream_management plugin enabled management tag + vhost access (no resource permissions needed). This issue is fixed in versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.0.0, < 4.0.22","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:08:46.026271Z","id":"CVE-2026-67218","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.22","matchCriteriaId":"F9CF5E9C-1315-47E2-B3FB-27A066E256F6"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34jw-rm7g-hph4","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67219","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:00.073","lastModified":"2026-10-19T20:38:08.573","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_binding/3 parses the routing key as an integer weight N and computes ring positions with lists:seq(NextN0, NextN0 + N - 1). validate_binding/2 only checks N >= 1 , no upper bound. The resulting list is stored in the exchange's Khepri record, replicated cluster-wide, and reloaded on restart. A user with write permission on a consistent-hash exchange and read on a queue can create a binding whose routing key (the hash-ring weight) is an arbitrarily large integer. The broker allocates a list of that many integers via lists:seq/2 and persists it to Khepri across all cluster nodes , a single binding with weight 100000000 allocates ~800 MB on every node and survives restarts. Preconditions include rabbitmq_consistent_hash_exchange plugin enabled write permission on a consistent-hash exchange + read on a queue (standard binding perms). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:19:46.502402Z","id":"CVE-2026-67219","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-m8pg-4x2h-jvgr","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67220","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:00.220","lastModified":"2026-10-19T20:38:14.697","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, add_binding/3 reads the rjms_erlang_selector argument and passes it through erl_scan:string/1 then erl_parse:parse_term/1. erl_scan:string/1 interns every atom literal it tokenizes. validate_binding/2 is a no-op (-> ok.), there is no length cap, and the surrounding try/catch cannot reclaim atoms. The Java JMS client compiles selectors client-side, but the server does not enforce this , a raw AMQP client can send arbitrary selector strings. An authenticated low-privilege AMQP user confined to one vhost can crash the entire broker node (cross-tenant DoS) in <100 bind calls. Preconditions include rabbitmq_jms_topic_exchange plugin enabled (bundled; required for any JMS deployment) Authenticated AMQP user with read on an x-jms-topic exchange + write on a queue (or configure to declare both). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:15:50.364609Z","id":"CVE-2026-67220","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-r3qr-4h63-mvj2","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67221","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:00.363","lastModified":"2026-10-19T20:38:22.587","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:46:20.959456Z","id":"CVE-2026-67221","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-312"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x5h5-588r-cv55","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67224","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:00.510","lastModified":"2026-10-19T20:38:28.197","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:join(TraceDir, Name ++ \".log\") where Name comes from PUT /api/traces/:vhost/:name. No safe_relative_path / traversal check is applied on the write side, while the read side (rabbit_tracing_files.erl) does call rabbit_misc:safe_relative_path/1 , proving the omission is an oversight, not design. The .log suffix is forced and the endpoint requires administrator. A user with the administrator tag can write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user via the tracing plugin's name parameter, e.g. /etc/cron.d/x.log (if writable) or overwrite existing .log files outside the trace directory. Preconditions include rabbitmq_tracing plugin enabled administrator tag Target path writable by rabbitmq OS user. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:19:57.876579Z","id":"CVE-2026-67224","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.1","matchCriteriaId":"41410FDE-4B5E-4466-B7C4-A62FEBFA0C80"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h7cq-qrr8-7vgc","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67228","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:00.657","lastModified":"2026-09-29T03:17:17.203","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a catch, already exists but is not used at this call site. lookup_component/1 calls rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized policymaker issuing roughly one million requests with distinct component values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions include Exploitation requires policymaker privileges and roughly one million requests.. This issue is fixed in versions 4.2.7 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.7","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:16:43.864338Z","id":"CVE-2026-67228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-73qp-fwh4-2q5g","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-67229","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:00.800","lastModified":"2026-10-19T20:38:36.170","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls rabbit_data_coercion:atomize_keys/1 (the unsafe variant using binary_to_atom) on the vhost metadata map. The 20 MB management body limit fits ~1M+ short keys. Admin-only. An administrator importing a crafted definitions file can crash the node in a single request: a vhosts entry with ~1M unique metadata keys exhausts the atom table during import. Preconditions include administrator tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:20:28.092524Z","id":"CVE-2026-67229","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-ggrw-qm45-hwpv","source":"security-advisories@github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-ggrw-qm45-hwpv","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67231","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:00.940","lastModified":"2026-10-19T20:38:54.217","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert \"matches\" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust anchor for path validation either. TLS client-authentication bypass: an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert. Preconditions include rabbitmq_trust_store plugin enabled and used as the TLS verify_fun Attacker knows or can guess the {Issuer, Serial} of at least one whitelisted cert (non-secret; exposed via CLI/logs/any cert copy). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:17:53.396979Z","id":"CVE-2026-67231","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-cw8c-4m83-9c6w","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67232","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:01.083","lastModified":"2026-10-19T20:39:00.817","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size, so cowboy's default of infinity applies. cowlib's cow_ws:parse_payload/9 calls zlib:inflate/2 on the compressed payload with no output-size limit. An attacker can negotiate permessage-deflate during the WebSocket upgrade and send a frame containing a zlib bomb (e.g. 50 KB → 5 GB). Decompression occurs in the connection process before websocket_handle/2 ever sees the MQTT bytes. An unauthenticated attacker can crash a RabbitMQ node running the Web-MQTT plugin by sending a single highly-compressed WebSocket frame (a few KB on the wire) that inflates to gigabytes in memory. The cowboy WebSocket handler decompresses the entire frame before the MQTT CONNECT packet is processed, so no credentials are required. Preconditions include rabbitmq_web_mqtt plugin enabled (not default, but common for browser clients) Network reachability to port 15675/15676 No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:53.562298Z","id":"CVE-2026-67232","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-409"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gmgx-hhg5-43gr","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67235","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:01.227","lastModified":"2026-10-19T20:39:07.837","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored without validation against max_message_size. The size check ran only when assembly completed. By declaring body_size = 2^63-1 and then streaming fragments, a client ensured that check_msg_size never fired, so the accumulated body size went unbounded. A reader process accumulates memory until the memory alarm fires, degrading all publishers cluster-wide, or until the node runs out of memory. The memory alarm provides only partial mitigation, since it is reactive rather than preventive. AMQP 0-9-1 is the most widely used protocol, and any publisher can trigger this condition. Preconditions include Any authenticated AMQP 0-9-1 client with publish permission can exploit this.. This issue is fixed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.6","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 3.13.0, < 3.13.15","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:54.889361Z","id":"CVE-2026-67235","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q8g2-pc7m-m3jw","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67240","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:01.370","lastModified":"2026-09-24T15:17:29.910","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unicode]; re:run is called with only [{capture, none}] - no explicit match_limit. A pattern like %_%_..._%X becomes ^.*?..*?.....*?.X$ with overlapping lazy quantifiers. The whole-expression cap is ?MAX_EXPRESSION_LENGTH=4096 chars / ?MAX_TOKENS=200; a LIKE string literal is one token, so ~2000 %_ pairs fit. SQL filters are accepted unconditionally at rabbit_amqp_session.erl:3264 (no feature flag). Evaluated per-message at rabbit_stream_queue.erl:1439. OTP's default 10M match_limit caps each match at ~100-200 ms (not seconds), and the re NIF yields to the scheduler. An authenticated AMQP 1.0 consumer with read+write on a stream queue can cause ~100-200 ms of CPU per delivered message via a crafted LIKE filter, multiplied across thousands of messages and parallel sessions - a substantial backtracking-driven CPU amplification. Preconditions include AMQP 1.0 with stream queues in use Attacker can attach a receiver with a filter (read permission) and publish messages with long property values (write permission). This issue is fixed in versions 4.2.7 and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 4.2.0, < 4.2.7","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:24:20.497820Z","id":"CVE-2026-67240","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-59c5-553c-57m2","source":"security-advisories@github.com"},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-59c5-553c-57m2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-67404","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:01.517","lastModified":"2026-10-19T20:39:14.883","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker to accept arbitrary JWTs. Preconditions include The OAuth2 plugin must be in use with no cacertfile configured and the OS CA bundle empty or unreadable (for example, in a minimal container), and the attacker must hold a network man-in-the-middle position.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:15:30.733266Z","id":"CVE-2026-67404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-37wx-r6q9-6fhj","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-67405","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T21:17:01.663","lastModified":"2026-10-19T19:36:27.747","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:11:31.782544Z","id":"CVE-2026-67405","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1385"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9c4f-rxxm-88q3","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-6718","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:01.803","lastModified":"2026-09-28T18:52:57.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:52.181401Z","id":"CVE-2026-6718","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-276"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-6721","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:01.927","lastModified":"2026-09-28T20:45:56.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the affected application."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-6721","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-6730","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:02.053","lastModified":"2026-09-28T20:47:20.347","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-6730","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-120"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-6794","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:02.177","lastModified":"2026-09-28T20:47:40.060","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit this flaw to corrupt heap memory and execute arbitrary code in the context of the affected process."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-6794","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-6925","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:02.303","lastModified":"2026-09-28T20:48:06.480","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot \" sequences ( /.. /) to view arbitrary files on the system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:45:04.582167Z","id":"CVE-2026-6925","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-6928","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:02.430","lastModified":"2026-09-29T14:08:24.273","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 references or accesses memory after it has been freed. This allows an attacker who can influence program execution or input may exploit this condition to corrupt memory, cause application crashes, or execute arbitrary code."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-6928","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-6935","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:02.553","lastModified":"2026-09-29T14:00:54.787","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 invokes operating system commands without fully qualifying executable paths or adequately restricting search path resolution. As a result, an attacker with local system access can manipulate the search path environment to execute untrusted or malicious code."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-6935","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-75886","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T21:17:02.683","lastModified":"2026-10-01T17:17:31.437","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"versions":[{"version":"1789939565","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"versions":[{"version":"1789904865","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"versions":[{"version":"1790095950","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"versions":[{"version":"1790112153","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"versions":[{"version":"1790142788","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"versions":[{"version":"1790130905","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openshift4/ose-console","cpes":["cpe:/a:redhat:openshift:4"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:53:58.349525Z","id":"CVE-2026-75886","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-441"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:70587","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:70617","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71447","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71450","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71453","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71454","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-75886","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517886","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-80379","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:02.940","lastModified":"2026-10-06T16:13:15.823","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:42:44.526054Z","id":"CVE-2026-80379","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-80412","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:03.067","lastModified":"2026-10-06T16:13:13.820","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:39:08.382490Z","id":"CVE-2026-80412","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-80425","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T21:17:03.190","lastModified":"2026-10-06T16:13:11.437","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:27:49.058786Z","id":"CVE-2026-80425","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-82369","sourceIdentifier":"sirt@brocade.com","published":"2026-09-23T21:17:03.317","lastModified":"2026-10-01T21:17:24.947","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient input sanitization of shell metacharacters in the Brocade SANnav CLI scripting component permits authenticated users to break out of restricted execution contexts on managed switches. An attacker with command execution permissions can leverage this flaw to run unauthorized shell commands across target fabric switches, bypassing command allow-lists and obtaining full administrative switch access. This vulnerability affects all Brocade SANnav versions before 3.0.1a."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.0.1a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.0.1a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-82369","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38994","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-96556","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T21:17:03.827","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Neethuharii CafeManagement. Affected by this vulnerability is the function addcashier of the file AddCashierCode.php. Executing a manipulation of the argument uname/pass/role/status can lead to improper authorization. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Neethuharii","product":"CafeManagement","cpes":["cpe:2.3:a:neethuharii:cafemanagement:*:*:*:*:*:*:*:*"],"versions":[{"version":"5f743043a9a04f903678697f061d2e220e544c09","status":"affected"},{"version":"66c837020e25af4866cb69b23ec3af4e0e1510c9","status":"affected"},{"version":"f80fe4442d5e15af5c78df3f22177a131c1e6f32","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:52:55.697306Z","id":"CVE-2026-96556","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/yashkeral/cve-writeups/blob/main/cafemanagement/03-missing-auth-account-creation.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96556","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/898980","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408959","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408959/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-19125","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T22:16:56.683","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"lynn999","product":"EthPress – Web3 Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.3.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:29:43.842521Z","id":"CVE-2026-19125","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Address.php#L419","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Login.php#L46","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Login.php#L51","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Plugin.php#L75","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3683106/ethpress/trunk/app/Login.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/267acbd7-379c-4930-aa85-3071dfcac5a5?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-57854","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T22:16:56.893","lastModified":"2026-10-16T15:10:00.103","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-75887","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T22:16:57.117","lastModified":"2026-10-23T06:17:07.253","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console","cpes":["cpe:/a:redhat:openshift:4.12::el9"],"versions":[{"version":"1790102793","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console","cpes":["cpe:/a:redhat:openshift:4.13::el9"],"versions":[{"version":"1791299243","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console","cpes":["cpe:/a:redhat:openshift:4.14::el9"],"versions":[{"version":"1790606051","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console","cpes":["cpe:/a:redhat:openshift:4.15::el9"],"versions":[{"version":"1791836468","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"versions":[{"version":"1790636171","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.17::el9"],"versions":[{"version":"1789939565","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.18::el9"],"versions":[{"version":"1789904865","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.19::el9"],"versions":[{"version":"1790095950","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.20::el9"],"versions":[{"version":"1790112153","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.21::el9"],"versions":[{"version":"1790142788","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"openshift4/ose-console-rhel9","cpes":["cpe:/a:redhat:openshift:4.22::el9"],"versions":[{"version":"1790130905","lessThan":"*","versionType":"rpm","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:14.603303Z","id":"CVE-2026-75887","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:70587","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:70617","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:70647","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71447","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71450","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71453","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71454","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:73853","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:73869","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:77321","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82813","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-75887","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517889","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-80423","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T22:16:57.270","lastModified":"2026-10-06T16:13:09.427","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to the exposure of namespace-wide secrets via accessible file mounts."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:03:19.747979Z","id":"CVE-2026-80423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81208","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T22:16:57.410","lastModified":"2026-10-06T16:13:07.390","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:14:36.406413Z","id":"CVE-2026-81208","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81536","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T22:16:57.553","lastModified":"2026-10-06T16:13:05.080","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:25:25.730668Z","id":"CVE-2026-81536","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81537","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T22:16:57.690","lastModified":"2026-10-06T16:13:02.813","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to OS command injection."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:39:14.867205Z","id":"CVE-2026-81537","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-86583","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T22:16:59.220","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv() with a NUL byte (\\0) as the escape character, while the importer parses the same file using SplFileObject::fgetcsv() with only a single delimiter argument, causing PHP's default backslash escape character to be applied instead; because the export column layout places display_name immediately before the role column and nickname immediately after, an attacker can store crafted values in those two profile fields — saved by WordPress core via the standard profile page — such that the escape mismatch causes the parser to merge the display_name cell into the role field and rebalance the column count via nickname, yielding administrator as the parsed role for their own row when it reaches the import_user function's add_role function. This makes it possible for authenticated attackers with Subscriber-level access or above to escalate their privileges to Administrator. Exploitation requires a site administrator to trigger the plugin's documented export re-import migration with both \"Update existing users\" and \"Update roles for existing users\" set to \"yes\"."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"carazo","product":"Import and export users and customers","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:22:48.155521Z","id":"CVE-2026-86583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.4.17/classes/batch_exporter.php#L459","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.4.17/classes/helper.php#L78","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.4.17/classes/import.php#L1356","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.4.17/classes/import.php#L872","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/import-users-from-csv-with-meta/tags/2.4.17/classes/import.php#L888","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3687349/import-users-from-csv-with-meta","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/5b0f3444-4c10-45ce-a00b-4ed6038b8846?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-93352","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T22:16:59.523","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file that passes all validation in MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not present in the blocklist, causing the file to be written to disk and executed as PHP when requested, enabling remote code execution with the privileges of the web server process."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"plank","product":"laravel-mediable","defaultStatus":"unaffected","repo":"https://github.com/plank/laravel-mediable","packageURL":"pkg:github/plank/laravel-mediable","versions":[{"version":"7.0.0","lessThan":"7.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:45:19.992775Z","id":"CVE-2026-93352","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/plank/laravel-mediable/commit/8ddb0e5b300084e91ad2cb18a6e7bc768bb7b008","source":"disclosure@vulncheck.com"},{"url":"https://github.com/plank/laravel-mediable/pull/396","source":"disclosure@vulncheck.com"},{"url":"https://github.com/plank/laravel-mediable/releases/tag/7.0.2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/laravel-mediable-rce-via-pht-file-upload","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96601","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T22:16:59.687","lastModified":"2026-09-24T16:17:26.690","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Abdurrab5","product":"online-makeup-store","cpes":["cpe:2.3:a:abdurrab5:online-makeup-store:*:*:*:*:*:*:*:*"],"modules":["Admin Login Handler"],"versions":[{"version":"336a4b09e5c840bdfe6dfde6616add0b20e4b4ee","status":"affected"},{"version":"c3ca96769c008a8a1518c8f9adbc7c8b52d83480","status":"affected"},{"version":"f804fe3ef5cf3570ced0fa34fb2de492a1306345","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:19:03.723854Z","id":"CVE-2026-96601","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/yashkeral/cve-writeups/blob/main/online-makeup-store/01-admin-login-sqli.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96601","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/898997","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408967","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408967/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96602","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T22:16:59.880","lastModified":"2026-09-29T03:17:22.027","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Abdurrab5","product":"online-makeup-store","cpes":["cpe:2.3:a:abdurrab5:online-makeup-store:*:*:*:*:*:*:*:*"],"modules":["Customer Login Handler"],"versions":[{"version":"336a4b09e5c840bdfe6dfde6616add0b20e4b4ee","status":"affected"},{"version":"c3ca96769c008a8a1518c8f9adbc7c8b52d83480","status":"affected"},{"version":"f804fe3ef5cf3570ced0fa34fb2de492a1306345","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:18:59.213751Z","id":"CVE-2026-96602","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/yashkeral/cve-writeups/blob/main/online-makeup-store/02-customer-login-sqli.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96602","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/898998","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408968","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408968/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96603","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T22:17:00.107","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Abdurrab5","product":"online-makeup-store","cpes":["cpe:2.3:a:abdurrab5:online-makeup-store:*:*:*:*:*:*:*:*"],"modules":["Admin Handler"],"versions":[{"version":"336a4b09e5c840bdfe6dfde6616add0b20e4b4ee","status":"affected"},{"version":"c3ca96769c008a8a1518c8f9adbc7c8b52d83480","status":"affected"},{"version":"f804fe3ef5cf3570ced0fa34fb2de492a1306345","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:14:13.081408Z","id":"CVE-2026-96603","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/yashkeral/cve-writeups/blob/main/online-makeup-store/03-broken-access-control.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96603","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/899001","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408969","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408969/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96604","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T22:17:00.297","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules/search.php of the component Search Module. The manipulation of the argument story leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SoftNews Media Group","product":"DataLife Engine","cpes":["cpe:2.3:a:softnews_media_group:datalife_engine:*:*:*:*:*:*:*:*"],"modules":["Search Module"],"versions":[{"version":"18.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:36:19.011898Z","id":"CVE-2026-96604","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://pastebin.com/nkMeTizS","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96604","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/899134","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408972","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408972/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-57168","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T23:17:11.087","lastModified":"2026-09-23T23:17:11.087","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-56120. Reason: This candidate is a duplicate of CVE-2026-56120. Notes: All CVE users should reference CVE-2026-56120 instead of this candidate."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-59980","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T23:17:11.473","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-hyper","product":"hpack","versions":[{"version":"< 4.2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:24:31.887152Z","id":"CVE-2026-59980","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://cs.opensource.google/go/x/net/+/master:http2/hpack/hpack.go;l=468;drc=8e2b117aee74f6b86c207a808b0255de45c0a18a","source":"security-advisories@github.com"},{"url":"https://docs.rs/http2/0.5.19/src/http2/hpack/decoder.rs.html#403","source":"security-advisories@github.com"},{"url":"https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c","source":"security-advisories@github.com"},{"url":"https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-70125","sourceIdentifier":"secure@microsoft.com","published":"2026-09-23T23:18:12.510","lastModified":"2026-10-05T18:11:18.297","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Microsoft Office Outlook Remote Code Execution Vulnerability"}],"affected":[{"source":"secure@microsoft.com","affectedData":[{"vendor":"Microsoft","product":"Microsoft 365 Apps for Enterprise","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2021","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.1","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom","status":"affected"}]},{"vendor":"Microsoft","product":"Microsoft Office LTSC 2024","platforms":["32-bit Systems","x64-based Systems"],"versions":[{"version":"16.0.0","lessThan":"https://aka.ms/OfficeSecurityReleases","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"secure@microsoft.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-70125","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secure@microsoft.com","type":"Primary","description":[{"lang":"en","value":"CWE-122"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*","matchCriteriaId":"3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*","matchCriteriaId":"CD25F492-9272-4836-832C-8439EBE64CCF"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"1D518075-3362-4D15-93B1-0E6C61518D16"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2021:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"1059BEC6-C30B-4F0F-A878-5267A21CBD85"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x64:*","matchCriteriaId":"55A9AFDA-D77B-4CC7-ACE5-3A2ABDA257D8"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:office_2024:-:*:*:*:ltsc:-:x86:*","matchCriteriaId":"8887D177-26A3-4008-89B6-50A9E9830F13"}]}]}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125","source":"secure@microsoft.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-96606","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T23:18:49.530","lastModified":"2026-09-29T17:17:16.290","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in LB-Link BL-CPE600EU 5.8.13. This vulnerability affects unknown code of the file Mifi_config.bin of the component Configuration Backup Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"LB-Link","product":"BL-CPE600EU","cpes":["cpe:2.3:a:lb-link:bl-cpe600eu:*:*:*:*:*:*:*:*"],"modules":["Configuration Backup Handler"],"versions":[{"version":"5.8.13","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:20:55.791306Z","id":"CVE-2026-96606","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-96606","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/901827","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408973","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408973/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96676","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T23:18:49.723","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Fast","product":"FAC1900R","cpes":["cpe:2.3:a:fast:fac1900r:*:*:*:*:*:*:*:*"],"modules":["uhttpd"],"versions":[{"version":"20190827_2.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:19:50.779546Z","id":"CVE-2026-96676","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/vul-find-FAST_FAC1900R-devDiscoverNotify","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96676","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/902770","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408999","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408999/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96678","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T23:18:49.923","lastModified":"2026-09-29T03:17:22.180","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the function validate of the file src/main/java/com/qingwenwei/util/NewUserFormValidator.java of the component Avatar Upload. The manipulation of the argument Username leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"weiqingwen","product":"spring-boot-forum","cpes":["cpe:2.3:a:weiqingwen:spring-boot-forum:*:*:*:*:*:*:*:*"],"modules":["Avatar Upload"],"versions":[{"version":"538eecc3c6b85fdf0768ab4e8354b48c0c17d94f","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:19:45.477702Z","id":"CVE-2026-96678","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/ssiled/cve/issues/3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96678","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/903881","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409002","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409002/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96680","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T23:18:50.117","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Message Handler. The manipulation of the argument body.url/paginationConfig/xPathConfig/body.urls/xPaths results in missing authorization. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"ByteDance","product":"Coze Scraper Extension","cpes":["cpe:2.3:a:bytedance:coze_scraper_extension:*:*:*:*:*:*:*:*"],"modules":["External Message Handler"],"versions":[{"version":"2.0.0","status":"affected"},{"version":"2.0.1","status":"affected"},{"version":"2.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:12:54.037634Z","id":"CVE-2026-96680","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/xryj920/chrome_extensions/blob/main/Coze%20Scraper%202.0.2%20Unrestricted%20External%20Message%20Handler%20Allows%20Website-Triggered%20Arbitrary%20URL%20Scraping","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96680","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904123","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409003","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409003/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-82370","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T00:17:21.777","lastModified":"2026-10-01T21:17:25.110","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Unauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service permits network-adjacent attackers to execute arbitrary administrative switch CLI commands and issue container management instructions. This could allow an attacker to alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This vulnerability affects Brocade SANnav versions before 3.0.1a."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"affected","versions":[{"version":"0","lessThan":"3.0.1a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.0.1a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-82370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38995","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-89078","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.060","lastModified":"2026-09-28T15:22:58.227","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a specially crafted regular expression in a CI/CD configuration."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"19.2","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-89078","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-415"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.7","matchCriteriaId":"2E337204-7AC0-4D9A-ADE3-D435F0E8F4CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.7","matchCriteriaId":"501CC95C-E50C-47C8-A7E0-68B106B22291"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/628577","source":"cve@gitlab.com","tags":["Issue Tracking"]},{"url":"https://hackerone.com/reports/4019059","source":"cve@gitlab.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-92470","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.193","lastModified":"2026-09-28T19:00:29.650","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"18.7","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:38:36.502715Z","id":"CVE-2026-92470","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.7.0","versionEndExcluding":"19.2.7","matchCriteriaId":"300491B5-6ECF-46CB-A6F1-69E0FB52153B"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/617719","source":"cve@gitlab.com","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-92529","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.323","lastModified":"2026-09-28T18:59:10.517","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with developer-role permissions to bypass admin-configured AI tool governance controls for workflows in namespaces they do not control due to improper authorization checks."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"19.1","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:05:48.675021Z","id":"CVE-2026-92529","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.1.0","versionEndExcluding":"19.2.7","matchCriteriaId":"B80C4185-9A73-4866-A169-F4B2F6BA048C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/605431","source":"cve@gitlab.com","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-92530","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.453","lastModified":"2026-09-28T18:58:24.633","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on the target instance due to improper reliance on ephemeral cache state during Direct Transfer imports."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"19.1","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:24:28.742595Z","id":"CVE-2026-92530","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.1.0","versionEndExcluding":"19.2.7","matchCriteriaId":"1B63D592-2D43-4407-8747-B6E2C1059588"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.1.0","versionEndExcluding":"19.2.7","matchCriteriaId":"B80C4185-9A73-4866-A169-F4B2F6BA048C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/628379","source":"cve@gitlab.com","tags":["Broken Link"]}]}},{"cve":{"id":"CVE-2026-92628","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.583","lastModified":"2026-09-28T15:22:49.920","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"18.6","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:10:16.617570Z","id":"CVE-2026-92628","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"18.6.0","versionEndExcluding":"19.2.7","matchCriteriaId":"CB03812E-36B6-4052-B376-6E3D3CE2B86C"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.6.0","versionEndExcluding":"19.2.7","matchCriteriaId":"216C90EC-E653-45F2-A838-B10DD81BDA6A"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/621933","source":"cve@gitlab.com","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-92874","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.713","lastModified":"2026-09-28T15:22:41.523","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with an MCP-scoped token to perform actions beyond the intended scope of that token due to improper authorization checks."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"18.3","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:09:38.009631Z","id":"CVE-2026-92874","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"18.3.0","versionEndExcluding":"19.2.7","matchCriteriaId":"D2DF7E33-826B-462B-A28D-0A12456E71AF"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"18.3.0","versionEndExcluding":"19.2.7","matchCriteriaId":"450D3E8E-881E-4DC6-8519-A47C34D1D556"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/618614","source":"cve@gitlab.com","tags":["Issue Tracking"]}]}},{"cve":{"id":"CVE-2026-93577","sourceIdentifier":"cve@gitlab.com","published":"2026-09-24T00:17:22.850","lastModified":"2026-09-28T15:22:15.293","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when compiling a specially crafted regular expression in a CI/CD configuration."}],"affected":[{"source":"cve@gitlab.com","affectedData":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","versions":[{"version":"19.2","lessThan":"19.2.7","versionType":"semver","status":"affected"},{"version":"19.3","lessThan":"19.3.3","versionType":"semver","status":"affected"},{"version":"19.4","lessThan":"19.4.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@gitlab.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-93577","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@gitlab.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.7","matchCriteriaId":"2E337204-7AC0-4D9A-ADE3-D435F0E8F4CB"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.2.0","versionEndExcluding":"19.2.7","matchCriteriaId":"501CC95C-E50C-47C8-A7E0-68B106B22291"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"053EF913-CD59-404C-8878-B42B122608DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"19.3.0","versionEndExcluding":"19.3.3","matchCriteriaId":"FDD16091-261D-4616-BF85-70CF011C6740"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:community:*:*:*","matchCriteriaId":"476CE485-460C-4EBE-AC16-D7AE6C30DF50"},{"vulnerable":true,"criteria":"cpe:2.3:a:gitlab:gitlab:19.4.0:*:*:*:enterprise:*:*:*","matchCriteriaId":"DED8DBAE-9FCD-40A4-9A9B-BAC26B4CBD44"}]}]}],"references":[{"url":"https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-4-1-released/","source":"cve@gitlab.com","tags":["Release Notes","Vendor Advisory"]},{"url":"https://gitlab.com/gitlab-org/gitlab/-/work_items/629758","source":"cve@gitlab.com","tags":["Issue Tracking"]},{"url":"https://hackerone.com/reports/3995696","source":"cve@gitlab.com","tags":["Permissions Required"]}]}},{"cve":{"id":"CVE-2026-96739","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T00:17:22.990","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"SEMCMS","cpes":["cpe:2.3:a:semcms:semcms:*:*:*:*:*:*:*:*"],"modules":["KindEditor Upload Interface"],"versions":[{"version":"4.0","status":"affected"},{"version":"4.1","status":"affected"},{"version":"4.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:36:04.254916Z","id":"CVE-2026-96739","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/CSDVi/cve/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96739","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904124","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409004","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409004/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96751","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T00:17:23.170","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the function setSync of the file /ajax/add_project.php. Such manipulation of the argument conn_settings leads to sql injection. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"pmTicket","product":"Project-Management-Software","cpes":["cpe:2.3:a:pmticket:project-management-software:*:*:*:*:*:*:*:*"],"versions":[{"version":"078fa56a782490c5059a0814f84df27984f4d7e2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:18:49.958274Z","id":"CVE-2026-96751","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://asciinema.org/a/1230576","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96751","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904342","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409005","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409005/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96762","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T00:17:23.353","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kvcache-ai","product":"mooncake","cpes":["cpe:2.3:a:kvcache-ai:mooncake:*:*:*:*:*:*:*:*"],"modules":["RPC Path Handler"],"versions":[{"version":"0.3.0","status":"affected"},{"version":"0.3.1","status":"affected"},{"version":"0.3.2","status":"affected"},{"version":"0.3.3","status":"affected"},{"version":"0.3.4","status":"affected"},{"version":"0.3.5","status":"affected"},{"version":"0.3.6","status":"affected"},{"version":"0.3.7","status":"affected"},{"version":"0.3.8","status":"affected"},{"version":"0.3.9","status":"affected"},{"version":"0.3.10","status":"affected"},{"version":"0.3.11","status":"affected"},{"version":"0.3.12","status":"affected"},{"version":"0.3.13.post1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:17:42.616673Z","id":"CVE-2026-96762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://gist.github.com/yyymk/76d099537af0e661dd01eacc82b9a7ea","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96762","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904600","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409016","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409016/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96763","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:16:59.627","lastModified":"2026-09-29T03:17:22.323","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kvcache-ai","product":"mooncake","cpes":["cpe:2.3:a:kvcache-ai:mooncake:*:*:*:*:*:*:*:*"],"modules":["MountSegment Request Processing"],"versions":[{"version":"0.3.0","status":"affected"},{"version":"0.3.1","status":"affected"},{"version":"0.3.2","status":"affected"},{"version":"0.3.3","status":"affected"},{"version":"0.3.4","status":"affected"},{"version":"0.3.5","status":"affected"},{"version":"0.3.6","status":"affected"},{"version":"0.3.7","status":"affected"},{"version":"0.3.8","status":"affected"},{"version":"0.3.9","status":"affected"},{"version":"0.3.10","status":"affected"},{"version":"0.3.11","status":"affected"},{"version":"0.3.12","status":"affected"},{"version":"0.3.13.post1","status":"affected"},{"version":"0.3.14-rc1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:P","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:41:13.416455Z","id":"CVE-2026-96763","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://gist.github.com/yyymk/fea24846dc31042cb472d7bd496a8438","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96763","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904605","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409018","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409018/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96764","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:16:59.813","lastModified":"2026-09-24T15:18:00.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex of the component Regular Expression Handler. Executing a manipulation can lead to allocation of resources. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"kvcache-ai","product":"mooncake","cpes":["cpe:2.3:a:kvcache-ai:mooncake:*:*:*:*:*:*:*:*"],"modules":["Regular Expression Handler"],"versions":[{"version":"0.3.0","status":"affected"},{"version":"0.3.1","status":"affected"},{"version":"0.3.2","status":"affected"},{"version":"0.3.3","status":"affected"},{"version":"0.3.4","status":"affected"},{"version":"0.3.5","status":"affected"},{"version":"0.3.6","status":"affected"},{"version":"0.3.7","status":"affected"},{"version":"0.3.8","status":"affected"},{"version":"0.3.9","status":"affected"},{"version":"0.3.10","status":"affected"},{"version":"0.3.11","status":"affected"},{"version":"0.3.12","status":"affected"},{"version":"0.3.14-rc1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:33:17.401895Z","id":"CVE-2026-96764","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://gist.github.com/yyymk/4699cc95ab9a559ee15a0fb798bd6c5d","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96764","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904607","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409019","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409019/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96772","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:17:00.010","lastModified":"2026-09-24T16:17:27.760","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Intelliants","product":"Subrion CMS","cpes":["cpe:2.3:a:intelliants:subrion_cms:*:*:*:*:*:*:*:*"],"versions":[{"version":"4.2.0","status":"affected"},{"version":"4.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:35:45.508683Z","id":"CVE-2026-96772","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/volksec/SubrionCMS-Security-Advisories/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96772","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904804","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409027","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409027/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96773","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:17:00.207","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $_SERVER['HTTP_REFERER'] causes open redirect. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Intelliants","product":"Subrion CMS","cpes":["cpe:2.3:a:intelliants:subrion_cms:*:*:*:*:*:*:*:*"],"modules":["Login Page"],"versions":[{"version":"4.2.0","status":"affected"},{"version":"4.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:17:08.186448Z","id":"CVE-2026-96773","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://github.com/volksec/SubrionCMS-Security-Advisories/issues/2","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96773","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904805","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409028","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409028/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96774","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T01:17:00.387","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SPON Communications","product":"IP Network Audio Device XC-9603","cpes":["cpe:2.3:a:spon_communications:ip_network_audio_device_xc-9603:*:*:*:*:*:*:*:*"],"modules":["Configuration File Download"],"versions":[{"version":"1.2.3_20181106 Build 107","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:16:31.291933Z","id":"CVE-2026-96774","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-96774","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/904898","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409033","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409033/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-18467","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T02:16:52.943","lastModified":"2026-09-24T16:17:07.393","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"paytiumsupport","product":"Paytium: Mollie payment forms & donations","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:38:06.322433Z","id":"CVE-2026-18467","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/payment-functions.php#L113","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/process-payment-functions.php#L1103","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/process-payment-functions.php#L21","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/process-payment-functions.php#L696","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/paytium/tags/5.0.3/includes/user-data-functions.php#L214","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3678569/paytium","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/caa1a42a-6bb2-42c8-aae7-fb1c895573a8?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-96777","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T02:16:53.563","lastModified":"2026-09-29T03:17:22.477","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appCore/ajax.adm_server.php?r=adm/userselector/getData of the component Multi-User-Selector AJAX Endpoint. This manipulation of the argument Name causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Forma","product":"LMS","cpes":["cpe:2.3:a:forma:lms:*:*:*:*:*:*:*:*"],"modules":["Multi-User-Selector AJAX Endpoint"],"versions":[{"version":"4.1.0","status":"affected"},{"version":"4.1.1","status":"affected"},{"version":"4.1.2","status":"affected"},{"version":"4.1.3","status":"affected"},{"version":"4.1.4","status":"affected"},{"version":"4.1.5","status":"affected"},{"version":"4.1.6","status":"affected"},{"version":"4.1.7","status":"affected"},{"version":"4.1.8","status":"affected"},{"version":"4.1.9","status":"affected"},{"version":"4.1.10","status":"affected"},{"version":"4.1.11","status":"affected"},{"version":"4.1.12","status":"affected"},{"version":"4.1.13","status":"affected"},{"version":"4.1.14","status":"affected"},{"version":"4.1.15","status":"affected"},{"version":"4.1.16","status":"affected"},{"version":"4.1.17","status":"affected"},{"version":"4.1.18","status":"affected"},{"version":"4.1.19","status":"affected"},{"version":"4.1.20","status":"affected"},{"version":"4.1.21","status":"affected"},{"version":"4.1.22","status":"affected"},{"version":"4.1.23","status":"affected"},{"version":"4.1.24","status":"affected"},{"version":"4.1.25","status":"affected"},{"version":"4.1.26","status":"affected"},{"version":"4.1.27","status":"affected"},{"version":"4.1.28","status":"affected"},{"version":"4.1.29","status":"affected"},{"version":"4.1.30","status":"affected"},{"version":"4.1.31","status":"affected"},{"version":"4.1.32","status":"affected"},{"version":"4.1.33","status":"affected"},{"version":"4.1.34","status":"affected"},{"version":"4.1.35","status":"affected"},{"version":"4.1.36","status":"affected"},{"version":"4.1.37","status":"affected"},{"version":"4.1.38","status":"affected"},{"version":"4.1.39","status":"affected"},{"version":"4.1.40","status":"affected"},{"version":"4.1.41","status":"affected"},{"version":"4.1.42","status":"affected"},{"version":"4.1.43","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:42:12.781448Z","id":"CVE-2026-96777","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/lorenzobruno7/advisory_formalms/tree/main","source":"cna@vuldb.com"},{"url":"https://github.com/lorenzobruno7/advisory_formalms_sql/tree/main","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96777","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/905111","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409034","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409034/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96803","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T02:16:53.770","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in java110 MicroCommunity up to 2.0. Affected is the function QueryServiceSMOImpl.fallBack of the file BusinessApi.java of the component fallBack API Endpoint. Such manipulation of the argument fallBackSql leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"java110","product":"MicroCommunity","cpes":["cpe:2.3:a:java110:microcommunity:*:*:*:*:*:*:*:*"],"modules":["fallBack API Endpoint"],"versions":[{"version":"2.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:03:35.552310Z","id":"CVE-2026-96803","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://gitee.com/yhx070424/MicroCommunity/issues/IK4014","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96803","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/905472","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409035","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409035/cti","source":"cna@vuldb.com"},{"url":"https://gitee.com/yhx070424/MicroCommunity/issues/IK4014","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96810","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T02:16:53.960","lastModified":"2026-09-24T16:17:27.900","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\\src\\main\\java\\cn\\huanzi\\qch\\baseadmin\\common\\controller\\CommonController.java of the component Add User Handler. The manipulation of the argument Username leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"huanzi-qch","product":"base-admin","cpes":["cpe:2.3:a:huanzi-qch:base-admin:*:*:*:*:*:*:*:*"],"modules":["Add User Handler"],"versions":[{"version":"52816b760cd53244989fd664bbb2b3d4edbfdbf1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:32:39.772615Z","id":"CVE-2026-96810","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/jac40577-art/cve-db/blob/master/BaseAdminSystem%20-%20Introduction_to_Storage-Based_XSS_Vulnerability.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96810","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/905724","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409062","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409062/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96880","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T02:16:54.147","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TaleLin","product":"lin-cms-spring-boot","cpes":["cpe:2.3:a:talelin:lin-cms-spring-boot:*:*:*:*:*:*:*:*"],"modules":["book Endpoint"],"versions":[{"version":"0.2.0","status":"affected"},{"version":"0.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:51:20.977235Z","id":"CVE-2026-96880","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%83.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96880","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906081","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409078","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409078/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97055","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T02:16:54.333","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRET) to an empty string, and Config.Validate() does not reject the empty value, so a deployment that does not configure a secret starts up and both signs and verifies session tokens with an empty HMAC key. Because the JWT tokenizer was the default provider, any such deployment is affected. An unauthenticated attacker who knows the ID of an existing user can forge a valid session token for that user — including an administrator — by signing the id, orgId and email claims with an empty key; the organization ID (and whether an email is registered) can be obtained without authentication from /api/v2/sessions/context. A forged refresh token can be exchanged at /api/v2/sessions/rotate for a new token pair and cannot be revoked, so it remains usable for its full lifetime (30 days by default). Fixed in v0.143.0, which requires a JWT secret when the jwt provider is selected and changes the default provider to opaque."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"SigNoz","product":"signoz","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/SigNoz/signoz","versions":[{"version":"0.8.0","lessThan":"0.143.0","versionType":"semver","status":"affected"},{"version":"0.143.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:57:48.983290Z","id":"CVE-2026-97055","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]}],"references":[{"url":"https://github.com/SigNoz/signoz/commit/67895d366d","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/b02aae2db3","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-c26w-g4j8-39m2","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/signoz-before-0.143.0-authentication-bypass-via-empty-jwt-secret","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-c26w-g4j8-39m2","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97056","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T02:16:54.500","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"SigNoz","product":"signoz","defaultStatus":"unaffected","packageURL":"pkg:golang/github.com/SigNoz/signoz","versions":[{"version":"0.98.0","lessThan":"0.143.0","versionType":"semver","status":"affected"},{"version":"0.143.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:55:59.241523Z","id":"CVE-2026-97056","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/SigNoz/signoz/commit/b02aae2db3","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/c122bc09b4","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/e2e9173986","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/commit/faaed20dbd","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/signoz-before-0.143.0-insufficient-session-expiration-authentication-bypass","source":"disclosure@vulncheck.com"},{"url":"https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96881","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T03:16:58.333","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in TaleLin lin-cms-spring-boot up to 0.2.1. Affected is the function getBooks of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TaleLin","product":"lin-cms-spring-boot","cpes":["cpe:2.3:a:talelin:lin-cms-spring-boot:*:*:*:*:*:*:*:*"],"modules":["book Endpoint"],"versions":[{"version":"0.2.0","status":"affected"},{"version":"0.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:04:31.016000Z","id":"CVE-2026-96881","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%832.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96881","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906082","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409079","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409079/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96882","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T03:16:58.577","lastModified":"2026-09-29T03:17:22.647","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TaleLin","product":"lin-cms-spring-boot","cpes":["cpe:2.3:a:talelin:lin-cms-spring-boot:*:*:*:*:*:*:*:*"],"modules":["book Endpoint"],"versions":[{"version":"0.2.0","status":"affected"},{"version":"0.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:43:35.907412Z","id":"CVE-2026-96882","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/hhhh333/CVE/blob/main/Lin-CMS-%E6%9C%AA%E6%8E%88%E6%9D%833.md","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96882","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906083","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409080","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409080/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96884","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T03:16:58.760","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"MantisZip","cpes":["cpe:2.3:a:mantiszip:mantiszip:*:*:*:*:*:*:*:*"],"modules":["Preview"],"versions":[{"version":"0.4.0","status":"affected"},{"version":"0.4.1","status":"affected"},{"version":"0.4.2","status":"affected"},{"version":"0.4.3","status":"affected"},{"version":"0.4.4","status":"affected"},{"version":"0.4.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:50:24.692997Z","id":"CVE-2026-96884","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gitee.com/yhx070424/MantisZip/issues/IK4AHB","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96884","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906093","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409081","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409081/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96891","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T03:16:58.950","lastModified":"2026-09-24T16:17:28.193","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in D-Link DIR-825 3.00b32. Affected is the function tunnel_set_params of the file tunnel.c of the component rp-l2tp. The manipulation of the argument peer_hostname  leads to out-of-bounds write. The attack may be initiated remotely."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"D-Link","product":"DIR-825","cpes":["cpe:2.3:h:d-link:dir-825:*:*:*:*:*:*:*:*"],"modules":["rp-l2tp"],"versions":[{"version":"3.00b32","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:32:03.699556Z","id":"CVE-2026-96891","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://tzh00203.notion.site/D-Link-DIR-825-L2TP-Host-Name-AVP-Out-of-Bounds-Write-33cb5c52018a80458ffec58b62096940","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96891","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906301","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409134","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409134/cti","source":"cna@vuldb.com"},{"url":"https://www.dlink.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97149","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T03:16:59.133","lastModified":"2026-10-06T18:16:59.117","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. An attacker holding a PUT TempURL for a single object can add an X-Copy-From header naming any object in the same account; the copy middleware copies that object to the destination, and the attacker then reads the victim's data back with a GET TempURL for the destination object. Copies across account boundaries are rejected. Only deployments using the shipped default proxy pipeline (tempurl and copy middleware) with account-level TempURL keys are affected."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenStack","product":"Swift","defaultStatus":"unaffected","repo":"https://opendev.org/openstack/swift","versions":[{"version":"2.4.0","lessThan":"2.35.5","versionType":"semver","status":"affected"},{"version":"2.36.0","lessThan":"2.36.4","versionType":"semver","status":"affected"},{"version":"2.37.0","lessThan":"2.37.4","versionType":"semver","status":"affected"},{"version":"2.38.0","lessThan":"2.38.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:53:29.868605Z","id":"CVE-2026-97149","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-184"}]}],"references":[{"url":"https://launchpad.net/bugs/2166876","source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/5","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-96892","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T04:18:04.790","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Edimax","product":"BR-6428nC","cpes":["cpe:2.3:a:edimax:br-6428nc:*:*:*:*:*:*:*:*"],"modules":["goform Handler"],"versions":[{"version":"1.16","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:48:59.165927Z","id":"CVE-2026-96892","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://tzh00203.notion.site/Edimax-BR-6428nC-Open-Redirect-via-submit-url-33db5c52018a808a8c34c1cb68db7aab","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96892","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906338","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409175","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409175/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96898","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T04:18:05.833","lastModified":"2026-09-24T16:17:28.330","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"yhx070424","product":"ShopXO","cpes":["cpe:2.3:a:shopxo:shopxo:*:*:*:*:*:*:*:*"],"modules":["Ueditor Upload Interface"],"versions":[{"version":"2.2.0","status":"affected"},{"version":"2.2.1","status":"affected"},{"version":"2.2.2","status":"affected"},{"version":"2.2.3","status":"affected"},{"version":"2.2.4","status":"affected"},{"version":"2.2.5","status":"affected"},{"version":"2.2.6","status":"affected"},{"version":"2.2.7","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:17:23.756599Z","id":"CVE-2026-96898","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://gitee.com/yhx070424/shopxo/","source":"cna@vuldb.com"},{"url":"https://gitee.com/yhx070424/shopxo/issues/IK4LPH","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96898","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/906413","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409201","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409201/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97151","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T04:18:06.027","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"mwilliamson","product":"mammoth.js","defaultStatus":"unaffected","collectionURL":"https://registry.npmjs.org","packageName":"mammoth","modules":["docx styles reader"],"programFiles":["lib/docx/styles-reader.js"],"programRoutines":[{"name":"readStylesXml"}],"repo":"https://github.com/mwilliamson/mammoth.js","packageURL":"pkg:npm/mammoth","versions":[{"version":"0","lessThan":"1.12.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:02:06.758652Z","id":"CVE-2026-97151","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/mwilliamson/mammoth.js/commit/2888fa158d67c1419199f152326e12a05618b53e","source":"cve@mitre.org"},{"url":"https://github.com/mwilliamson/mammoth.js/commit/31f0c370be4b95ac4fa285fea3be970606735f16","source":"cve@mitre.org"},{"url":"https://raw.githubusercontent.com/mwilliamson/mammoth.js/master/NEWS","source":"cve@mitre.org"},{"url":"https://www.npmjs.com/package/mammoth","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97152","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T04:18:06.213","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Nanomsg","product":"Nanomsg","defaultStatus":"unaffected","modules":["websocket"],"programFiles":["ws_handshake.c"],"repo":"https://github.com/nanomsg/nanomsg","versions":[{"version":"0.5.0","lessThan":"1.2.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:46:52.122399Z","id":"CVE-2026-97152","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/nanomsg/nanomsg/pull/1130","source":"cve@mitre.org"},{"url":"https://github.com/nanomsg/nanomsg/releases/tag/1.2.3","source":"cve@mitre.org"},{"url":"https://nanomsg.org","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-97155","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T04:18:06.397","lastModified":"2026-09-26T23:16:42.507","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"Fabasoft","product":"Folio Client","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"2026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:39:42.994451Z","id":"CVE-2026-97155","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://help.supportservices.fabasoft.com/index.php?topic=doc/Knowledge-Base/changes-to-fabasoft-folio-client-security-settings.htm","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-14780","sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","published":"2026-09-24T06:17:00.567","lastModified":"2026-10-13T05:16:32.177","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox.  \n\nA successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system."}],"affected":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","affectedData":[{"vendor":"PaperCut","product":"PaperCut NG/MF","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24.1.11","versionType":"semver","status":"affected"},{"version":"25.0.0","lessThan":"25.0.12","versionType":"semver","status":"affected"},{"version":"26.0.0","lessThan":"26.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-14780","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}]}},{"cve":{"id":"CVE-2026-74991","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:00.943","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPForms  WordPress plugin before 2.0.2 does not verify that a Stripe payment object supplied during a public form submission belongs to it before acting on it, allowing unauthenticated users to trigger a full refund and an immediate subscription cancellation against payments created by other applications on the site owner's Stripe account."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPForms","defaultStatus":"unaffected","versions":[{"version":"1.8.8.2","lessThan":"2.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:37:40.135706Z","id":"CVE-2026-74991","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e539d37e-91bb-4d79-b812-ac3c6c1a0f70/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-80338","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.317","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline.\nExploitation requires the site's  or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"CMB2","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.13.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:37:26.261371Z","id":"CVE-2026-80338","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7402e0b0-54de-42b3-9032-ae225fb4e76a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-80513","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.430","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object.\nNo POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"wpForo Forum","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:37:15.714540Z","id":"CVE-2026-80513","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://wpscan.com/vulnerability/09c9b9e7-c178-4f05-80d8-d4d77b7c5050/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82195","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.540","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The 10Web Booster  WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator from completing a legitimate connection."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"10Web Booster","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.34.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:36:40.745716Z","id":"CVE-2026-82195","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c6e4763e-e4db-4318-9631-06ee7426f3ae/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82849","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.650","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Masteriyo LMS  WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. The ownership check it applies is skipped whenever the requested account is not named with a non-zero value, in which case the records of every learner on the site are returned at once."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Masteriyo LMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:35:56.760373Z","id":"CVE-2026-82849","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/8114501a-3591-4d8c-b73e-a598756d45d7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82850","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.770","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Masteriyo LMS  WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Masteriyo LMS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:35:39.734415Z","id":"CVE-2026-82850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b26150aa-9220-4eb3-a160-0f5301faacc7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84151","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:01.873","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Post Grid  WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it site-wide, allowing users with the Contributor role and above to store iframe, style and input elements that are normally stripped from their content, leading to HTML injection (phishing frames, CSS defacement and spoofed input forms) that renders to any visitor and to administrators reviewing the content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"The Post Grid","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:35:16.466485Z","id":"CVE-2026-84151","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6601a305-a76f-40fe-8d78-c6a33a66d5f3/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88843","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.207","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"3.5.29","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:35:02.540672Z","id":"CVE-2026-88843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://wpscan.com/vulnerability/fffc0d8c-256e-417d-b76c-251948b9f1ed/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88845","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.313","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own account."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"2.3.0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:49.841707Z","id":"CVE-2026-88845","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a1693fd3-7ba9-4a59-99ea-7f9fd00a9de1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88846","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.437","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users to create accounts, and be logged into them, on sites where registration has been deliberately disabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"2.3.0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:39.104982Z","id":"CVE-2026-88846","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/57b0dd3f-bd83-4fb7-b98d-c999026910cd/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88847","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.533","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create course progress records for courses they have no access to."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:24.594406Z","id":"CVE-2026-88847","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c42e9b3a-5a0d-4e16-b18a-4184c09bcb5a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89002","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.633","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPeMatico RSS Feed Fetcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.26","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:14.011197Z","id":"CVE-2026-89002","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6820fac6-3238-4470-a865-677c4442f658/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89004","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.740","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by other users, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPeMatico RSS Feed Fetcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.26","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:34:02.613602Z","id":"CVE-2026-89004","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1568f9e4-defe-423a-a631-e0afd829b972/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89005","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.843","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session of any higher-privileged user who later views the campaign."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPeMatico RSS Feed Fetcher","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.8.26","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:33:48.662810Z","id":"CVE-2026-89005","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1c6f4da0-d7e8-4f50-851f-f794552db985/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93661","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:03.943","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Manager  WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Events Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"7.4.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:33:34.908014Z","id":"CVE-2026-93661","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/8f1c665e-15e4-4b5d-853d-919723614611/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93662","sourceIdentifier":"contact@wpscan.com","published":"2026-09-24T06:17:04.050","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Manager  WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Events Manager","defaultStatus":"unaffected","versions":[{"version":"7.4.1","lessThan":"7.4.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T10:33:25.889458Z","id":"CVE-2026-93662","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5669c4e6-edec-4963-8eb9-fc66d2488049/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-97168","sourceIdentifier":"security@synology.com","published":"2026-09-24T06:17:04.150","lastModified":"2026-09-24T14:18:22.483","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: it is a suggestion"}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-97176","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T06:17:04.227","lastModified":"2026-09-26T23:16:43.073","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how session re-evaluations are handled, Keycloak may incorrectly issue a token at the lower security level instead of enforcing the required higher level, potentially allowing unauthorized access to sensitive resources that rely on these security claims."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:39:58.730347Z","id":"CVE-2026-97176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97176","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539964","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-97177","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T06:17:04.380","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This allows a delegated administrator, who should be restricted from resetting passwords, to change a user's credentials and take over their account."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.7,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:57:34.967035Z","id":"CVE-2026-97177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97177","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539965","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-11744","sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","published":"2026-09-24T07:16:32.100","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize input received during the NFC card reading process before passing it to the application's web view interface. A local attacker with physical access to the device and a specially crafted NFC card or emulator could exploit this flaw to execute arbitrary code within the context of the application's user interface. This could result in unauthorized actions or information disclosure."}],"affected":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","affectedData":[{"vendor":"PaperCut","product":"PaperCut Hive","defaultStatus":"unaffected","modules":["Embedded App for Ricoh"],"versions":[{"version":"2.0.0","lessThan":"2.3.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":3.8,"baseSeverity":"LOW","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:40:59.451126Z","id":"CVE-2026-11744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}]}},{"cve":{"id":"CVE-2026-81645","sourceIdentifier":"psirt@huawei.com","published":"2026-09-24T07:16:33.307","lastModified":"2026-09-24T15:17:40.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability."}],"affected":[{"source":"psirt@huawei.com","affectedData":[{"vendor":"Huawei","product":"HarmonyOS","defaultStatus":"unaffected","versions":[{"version":"6.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@huawei.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.5,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:40:03.421121Z","id":"CVE-2026-81645","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@huawei.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://consumer.huawei.com/en/support/bulletin/2026/9/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinlaptops/2026/9/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinvision/2026/9/","source":"psirt@huawei.com"},{"url":"https://consumer.huawei.com/en/support/bulletinwearables/2026/9/","source":"psirt@huawei.com"}]}},{"cve":{"id":"CVE-2026-82077","sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","published":"2026-09-24T07:16:33.457","lastModified":"2026-10-13T04:17:22.010","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings."}],"affected":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","affectedData":[{"vendor":"PaperCut","product":"PaperCut NG/MF","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24.1.10","versionType":"semver","status":"affected"},{"version":"25.0.0","lessThan":"25.0.13","versionType":"semver","status":"affected"},{"version":"26.0.0","lessThan":"26.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-82077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}]}},{"cve":{"id":"CVE-2026-87739","sourceIdentifier":"eb41dac7-0af8-4f84-9f6d-0272772514f4","published":"2026-09-24T07:16:34.780","lastModified":"2026-10-13T04:17:22.743","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information."}],"affected":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","affectedData":[{"vendor":"PaperCut","product":"PaperCut NG/MF","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"24.1.10","versionType":"semver","status":"affected"},{"version":"25.0.0","lessThan":"25.0.13","versionType":"semver","status":"affected"},{"version":"26.0.0","lessThan":"26.0.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"YES","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:42:13.527939Z","id":"CVE-2026-87739","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"eb41dac7-0af8-4f84-9f6d-0272772514f4","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.papercut.com/kb/Main/security-bulletin-sep-2026/","source":"eb41dac7-0af8-4f84-9f6d-0272772514f4"}]}},{"cve":{"id":"CVE-2026-97181","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-24T08:17:03.280","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"ezGlobal","product":"GPM LIGHT","defaultStatus":"unaffected","versions":[{"version":"all","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:39:45.881388Z","id":"CVE-2026-97181","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-497"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11217-86b58-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11216-9ce77-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-77193","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T09:17:07.877","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"eesywp","product":"eesy_ID2WP – Publish InDesign HTML5","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.0.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:54:58.770435Z","id":"CVE-2026-77193","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3662793/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/ad266e0f-fc69-4550-b89c-c32ce1221ee4?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-78308","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.043","lastModified":"2026-10-15T02:20:16.420","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:36:13.592917Z","id":"CVE-2026-78308","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"},{"url":"https://pellera.com/blog/delta-electronics-diaenergie-unauthenticated-remote-code-execution-vulnerability-chain/","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78309","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.187","lastModified":"2026-10-15T03:17:11.340","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SQL Injection vulnerability in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:35:52.560561Z","id":"CVE-2026-78309","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"},{"url":"https://pellera.com/blog/delta-electronics-diaenergie-unauthenticated-remote-code-execution-vulnerability-chain/","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78310","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.323","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Authorization Bypass Through User-Controlled Key in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:33:52.598510Z","id":"CVE-2026-78310","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78311","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.440","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SQL Injection vulnerability in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:35:20.495938Z","id":"CVE-2026-78311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78312","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.553","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Path Traversal in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:33:33.140598Z","id":"CVE-2026-78312","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-78313","sourceIdentifier":"759f5e80-c8e1-4224-bead-956d7b33c98b","published":"2026-09-24T09:17:08.673","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Access Control in DIAEnergie.\n\nThis issue affects DIAEnergie: before 1.11.00.022."}],"affected":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","affectedData":[{"vendor":"Deltaww","product":"DIAEnergie","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.11.00.022","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:44:30.548734Z","id":"CVE-2026-78313","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"759f5e80-c8e1-4224-bead-956d7b33c98b","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2026-00014_DIAEnergie%20Multiple%20Vulberabilities%20(CVE-2026-78308%20~%2078313).pdf","source":"759f5e80-c8e1-4224-bead-956d7b33c98b"}]}},{"cve":{"id":"CVE-2026-85682","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T09:17:08.797","lastModified":"2026-09-24T15:17:46.703","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin transmitting a wp_rest nonce to window.opener via postMessage() with a wildcard targetOrigin. This makes it possible for unauthenticated attackers to steal a REST nonce scoped to a logged-in Administrator and use it to change the Administrator's email address and password, resulting in full account takeover. The Administrator must open an attacker-controlled page in order to exploit this vulnerability."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"yourownprogrammer","product":"YOP Poll","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"7.0.10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:34:56.198122Z","id":"CVE-2026-85682","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3690945/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3574182-1bda-49b2-aac7-60f862891b46?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-97185","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T09:17:08.937","lastModified":"2026-10-19T13:16:59.973","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could exploit this by convincing a user to load a malicious preset file, potentially causing a crash or enabling arbitrary code execution."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp:2.8","cpes":["cpe:/a:redhat:enterprise_linux:8::appstream"],"versions":[{"version":"8100020261015094823.4c9c024f","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"versions":[{"version":"2:3.0.4-4.el9_8.14","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"gimp","cpes":["cpe:/o:redhat:enterprise_linux:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:38:43.555462Z","id":"CVE-2026-97185","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:75575","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:84744","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-97185","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539980","source":"secalert@redhat.com"},{"url":"https://gitlab.gnome.org/GNOME/gimp/-/work_items/16788","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-12227","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T10:17:32.623","lastModified":"2026-09-24T16:17:06.650","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"visualcomposer","product":"Visual Composer Website Builder","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"45.16.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:38:03.709954Z","id":"CVE-2026-12227","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-98"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3619572/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/486c1c7c-5a66-42d3-85b0-13ce52a16ed1?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-15731","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T10:17:36.433","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"magazine3","product":"WP Multilang – Translation and Multilingual Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.4.31","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:31:51.518408Z","id":"CVE-2026-15731","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3637485/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/31c7b12c-eaab-405e-90da-3c5e8ab47245?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-18335","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T10:17:37.637","lastModified":"2026-09-24T16:17:07.287","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 6.2.0 via the 'kirki_data' Parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"themeum","product":"Kirki – Freeform Page Builder, Website Builder & Customizer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:50.774268Z","id":"CVE-2026-18335","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3636487/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/461be8a5-bf72-4028-88e6-bf6544120ac6?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-4637","sourceIdentifier":"551230f0-3615-47bd-b7cc-93e92e730bbf","published":"2026-09-24T10:17:37.813","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \\\".htm\\\", the web interface returns an HTTP 403 \\\"Forbidden Path\\\" error page that echoes the requested URL path into the HTML response body without proper output encoding or sanitization.\n\n\n\n\nAn unauthenticated, remote attacker can craft a URL containing an HTML/JavaScript payload in the path (e.g. https:////welcome.htm) and, once a victim with an active PRTG session opens the crafted link, execute arbitrary JavaScript in the security context of the PRTG web interface. Because the PRTG session cookie is not protected with the HttpOnly attribute, successful exploitation allows the attacker to read and exfiltrate the victim's session cookie, potentially leading to session hijacking."}],"affected":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","affectedData":[{"vendor":"Paessler GmbH","product":"PRTG Network Monitor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"26.2.120.1449","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:19:37.419469Z","id":"CVE-2026-4637","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://paessler.freshdesk.com/en/support/solutions/articles/76000088640","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://r.sec-consult.com/paessler","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://www.paessler.com/de/download/","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://www.paessler.com/prtg/prtg-network-monitor","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-paessler-prtg-network-monitor/","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-57590","sourceIdentifier":"security@apache.org","published":"2026-09-24T10:17:38.010","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group.\n\n\n\nThis issue affects Apache DolphinScheduler: before 3.4.3.\n\n\n\nUsers are recommended to upgrade to version 3.4.3, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache DolphinScheduler","defaultStatus":"unaffected","collectionURL":"https://repo.maven.apache.org/maven2","packageName":"org.apache.dolphinscheduler:dolphinscheduler-api","packageURL":"pkg:maven/org.apache.dolphinscheduler/dolphinscheduler-api","versions":[{"version":"0","lessThan":"3.4.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:37:30.984797Z","id":"CVE-2026-57590","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://lists.apache.org/thread/3ncvptkjw9h6s8mjxlwwo30bxxgol6ry","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/3","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-92905","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-24T10:17:38.157","lastModified":"2026-09-24T14:51:56.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine EventLog Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"13071","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Log360","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"13071","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:41:41.970749Z","id":"CVE-2026-92905","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-248"}]}],"references":[{"url":"https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-4638","sourceIdentifier":"551230f0-3615-47bd-b7cc-93e92e730bbf","published":"2026-09-24T11:16:45.953","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter. \n\n\n\n\nAny PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output."}],"affected":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","affectedData":[{"vendor":"Paessler GmbH","product":"PRTG Network Monitor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"26.2.120.1449","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:13:17.297572Z","id":"CVE-2026-4638","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"551230f0-3615-47bd-b7cc-93e92e730bbf","type":"Secondary","description":[{"lang":"en","value":"CWE-209"}]}],"references":[{"url":"https://paessler.freshdesk.com/en/support/solutions/articles/76000088640","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://r.sec-consult.com/paessler","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://www.paessler.com/de/download/","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"},{"url":"https://www.paessler.com/prtg/prtg-network-monitor","source":"551230f0-3615-47bd-b7cc-93e92e730bbf"}]}},{"cve":{"id":"CVE-2026-79680","sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","published":"2026-09-24T11:16:47.117","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session."}],"affected":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","affectedData":[{"vendor":"qt","product":"qt","defaultStatus":"unaffected","modules":["qtvncserver"],"versions":[{"version":"6.4.0","lessThan":"6.8.9","versionType":"python","status":"affected"},{"version":"6.9.0","lessThan":"6.11.3","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:D/RE:L/U:X","baseScore":4.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"LOW","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:17:35.115651Z","id":"CVE-2026-79680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://codereview.qt-project.org/c/qt/tqtc-qtvncserver/+/759160","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"},{"url":"https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-79680:","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}]}},{"cve":{"id":"CVE-2026-97179","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T11:17:06.600","lastModified":"2026-09-24T16:17:28.597","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of the argument fileUrl leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"O2OA","cpes":["cpe:2.3:a:o2oa:o2oa:*:*:*:*:*:*:*:*"],"modules":["Cipher Connection Handler"],"versions":[{"version":"9.5.0","status":"affected"},{"version":"9.5.1","status":"affected"},{"version":"9.5.2","status":"affected"},{"version":"9.5.3","status":"affected"},{"version":"10.0.0","status":"affected"},{"version":"10.0.1","status":"affected"},{"version":"10.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:14:49.203301Z","id":"CVE-2026-97179","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/2H-K/myvuls/issues/3","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97179","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907501","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409281","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409281/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-16302","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T12:17:11.637","lastModified":"2026-09-24T14:40:36.103","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function,  which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"brainstormforce","product":"Spectra Legacy – Gutenberg Blocks","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.20.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T11:53:10.888142Z","id":"CVE-2026-16302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3630074/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/eede8a1e-db33-4c07-9991-9def75dddc87?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-19532","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T12:17:12.030","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal.\n\nThis issue affects Liman MYS: from 2.3.2 before 2.3.4-1124."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"HAVELSAN Inc.","product":"Liman MYS","defaultStatus":"unaffected","versions":[{"version":"2.3.2","lessThan":"2.3.4-1124","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:19:46.434369Z","id":"CVE-2026-19532","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1169","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-3253","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T12:17:12.160","lastModified":"2026-09-24T15:17:21.977","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7.21. This makes it possible for authenticated attackers, with Contributor-level access and above, to create or delete arbitrary signup forms."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"mailerlite","product":"MailerLite – Signup forms (official)","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.7.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:33:53.170720Z","id":"CVE-2026-3253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3505999/","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1d845767-1e5f-43f0-9fc6-a897c2d5c3dd?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-4806","sourceIdentifier":"security@wordfence.com","published":"2026-09-24T12:17:12.307","lastModified":"2026-09-24T16:17:07.523","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option() function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to to export or reset(delete) the plugin's settings."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"alexvtn","product":"Custom Thank You Page for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"1.1.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:05:23.275023Z","id":"CVE-2026-4806","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3507079","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a010d1a2-b848-4d62-b176-a2c8e2027656?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-7169","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-24T12:17:12.973","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\\ProgramData\\Evope\\’ directory. The ‘Evope.Service.exe’ component, which runs with ‘NT AUTHORITY\\SYSTEM’ privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Evope Collector","product":"Evope Collector","defaultStatus":"unaffected","versions":[{"version":"1.1.6.9.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:05:07.092305Z","id":"CVE-2026-7169","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/uncontrolled-search-path-element-evope-collector","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-97311","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T12:17:13.943","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions that should limit their view to specific groups."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T12:31:24.446908Z","id":"CVE-2026-97311","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97311","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-19072","sourceIdentifier":"cve@rapid7.com","published":"2026-09-24T13:17:09.500","lastModified":"2026-09-25T04:17:34.920","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field \"compiled_collector_args\" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who can schedule a hunt (minimal role of \"investigator\" ) to set the compiled VQL statements for the hunt bypassing any ACL checks that would normally be applied.\n\n\n\n\nThis flaw can then be escalated to allow the \"investigator\" user to run arbitrary VQL statements as an administrator user on the Velociraptor server."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-19072","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-164"},{"lang":"en","value":"CWE-1269"}]}],"references":[{"url":"https://docs.velociraptor.app/announcements/advisories/cve-2026-19072/","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-88907","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T13:17:15.873","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass.\n\nThis issue affects UlakPDF: through 09092026."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"TÜBİTAK ULAKBİM","product":"UlakPDF","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"09092026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:41:31.719339Z","id":"CVE-2026-88907","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1170","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-88916","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T13:17:16.060","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation.\n\nThis issue affects UlakPDF: through 09092026."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"TÜBİTAK ULAKBİM","product":"UlakPDF","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"09092026","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:41:52.048253Z","id":"CVE-2026-88916","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1170","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-94416","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T13:17:17.620","lastModified":"2026-10-21T20:17:27.867","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a new service key for the Controller service cluster. Because service-key creation is not restricted to the installer-provisioned provisioning path, an administrator-issued key is cryptographically indistinguishable from a legitimate one and can be used to forge a service-authentication token that impersonates the Controller service. Combined with the gateway OIDC workload-identity endpoint (enabled via FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED), the attacker can drive the gateway to sign Workload Identity Tokens (WITs) for arbitrary Controller workloads. A downstream resource server such as HashiCorp Vault that trusts the gateway OIDC key will accept the forged WIT and return the AAP credentials bound to that workload, disclosing secrets beyond the attacker's authorization boundary."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"automation-gateway","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:2.6.20261019-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/gateway-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1792429216","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/gateway-rhel8","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-26/gateway-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T13:58:49.431691Z","id":"CVE-2026-94416","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:87004","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:87124","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-94416","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537465","source":"secalert@redhat.com"},{"url":"https://github.com/ansible/ansible.platform/pull/254","source":"secalert@redhat.com"},{"url":"https://github.com/ansible/jewel/pull/235","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96515","sourceIdentifier":"vdisclose@cert-in.org.in","published":"2026-09-24T13:17:17.787","lastModified":"2026-10-12T12:17:15.633","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"vdisclose@cert-in.org.in","tags":["disputed"]}],"descriptions":[{"lang":"en","value":"This\nvulnerability exists in the Netlink ICT HG323RW router due to insufficient\nauthorization and input validation controls in the diagnostic script import\nfunctionality. An authenticated attacker could exploit this vulnerability by\nuploading and executing a specially crafted script through the web management\ninterface.\n\n\n\n\n\nSuccessful exploitation of this vulnerability\ncould allow the attacker to execute arbitrary operating system commands with\nroot privileges resulting in complete compromise of the affected device."}],"affected":[{"source":"vdisclose@cert-in.org.in","affectedData":[{"vendor":"Netlink ICT Pvt Ltd","product":"Netlink ICT HG323RW Router","defaultStatus":"unaffected","versions":[{"version":"Hardware Version (V3.7) and Affected Firmware (3.1.02-260228 Netlinkver)","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"vdisclose@cert-in.org.in","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:40:29.568639Z","id":"CVE-2026-96515","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"vdisclose@cert-in.org.in","type":"Secondary","description":[{"lang":"en","value":"CWE-434"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0473","source":"vdisclose@cert-in.org.in"}]}},{"cve":{"id":"CVE-2026-97182","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T13:17:19.507","lastModified":"2026-09-24T15:18:01.087","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src/main/java/run/halo/app/content/comment/ReplyNotificationSubscriptionHelper.java of the component SpEL Handler. Such manipulation leads to improper neutralization. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"halo-dev","product":"Halo","cpes":["cpe:2.3:a:halo:halo:*:*:*:*:*:*:*:*"],"modules":["SpEL Handler"],"versions":[{"version":"2.25.0","status":"affected"},{"version":"2.25.1","status":"affected"},{"version":"2.25.2","status":"affected"},{"version":"2.25.3","status":"affected"},{"version":"2.25.4","status":"affected"},{"version":"2.26.0","status":"affected"},{"version":"2.26.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:32:48.451763Z","id":"CVE-2026-97182","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-707"}]}],"references":[{"url":"https://note-hxlab.wetolink.com/share/jTI97vuXfcCY","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97182","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907507","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409299","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409299/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-17413","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:11.887","lastModified":"2026-09-30T16:59:47.140","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the RTAS firmware-to-OS interface. An attacker with administrator-level (root) access to a logical partition can send a specially crafted request to partition firmware, causing the partition to crash and become unavailable. Other partitions on the same managed system are not affected."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:55:33.505196Z","id":"CVE-2026-17413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-129"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289124","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-17503","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.063","lastModified":"2026-09-30T16:57:44.550","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:58.999216Z","id":"CVE-2026-17503","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289133","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-17504","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.230","lastModified":"2026-09-29T14:58:26.860","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime. An attacker with root access to a partition can send a specially crafted request to the partition firmware runtime, causing it to crash with possible memory corruption."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":0.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:31:35.705386Z","id":"CVE-2026-17504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"C016EFBA-A371-4264-A823-A7635D39F6D9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"B8707806-84E4-442B-A29F-7BF44514F8DA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"6B512BF5-7D6B-45EA-97B8-F22B63A62270"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"25BCA648-5FF1-4B90-98ED-23E5BB217465"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"BC8256E1-574D-4666-BE1B-45977348AC86"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"2165EAA9-EDC9-4010-9D31-294F9414A9E6"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"3F8C1054-A539-468C-9A5F-E6E686C6CE8A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"085F1C27-D806-4E4B-A44A-BB3C056CFCF7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"37868E6E-7759-4CCB-995E-BDB7F61F6818"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"50916B93-7340-4344-AF34-91836ABE508F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"9F0FE92C-3510-475A-8D02-ED17ADD87CD0"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"FECCD687-64E7-45B4-BCB7-AEF25164D049"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"DC4CCBFC-3120-475D-BF75-025C04E41B91"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"BE428FBB-4DDC-4E05-A5C3-F37BE9395723"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"6505E499-E766-451D-9996-1668BE53AAF8"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"109DE27E-5F87-4BD0-8C48-F72A1C2AD55D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"AA6D803F-DD5C-49A7-BE93-68981C124C69"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"0BB54554-C9DC-4072-A205-EA9DD4E15688"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"FA4B835D-CEAB-422B-9F38-F63AF84396C3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"51C2576F-E4DD-4002-9E41-CF89F92E2064"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"41572D5A-C3A2-4294-9AF9-D4824675B4A3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"EEBFE6F7-E6D8-47AC-B011-751FB9BC3D50"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"D6EA818B-DC65-4F2D-9FC9-C610FFABE3DD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"2F04E3C9-94C6-42B0-9FBD-4AC5FEF42A1F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.81","matchCriteriaId":"0524365D-8379-4B10-B9C5-FF80EE84BA27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.31","matchCriteriaId":"E8049F52-227B-4CCA-B059-5821F9B41C95"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:fw1120.00:*:*:*:*:*:*:*","matchCriteriaId":"F518B3DD-3F25-4581-9103-6CD4D8DA54C7"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"0C406C5A-454C-4454-861F-80E629B68418"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"FBE7D8B3-902D-4CD1-9F31-454E293A79B3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"CD77C09F-AF62-4CD8-B64C-CDF50D696648"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"54831AF9-D748-4649-A0ED-896341845BCD"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"64FD3222-EEFD-4533-A088-B05F04E0831D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"C99CF91B-A98D-4795-A8AE-998713989ABE"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h3","matchCriteriaId":"272B1267-28AC-4BDB-93C4-9804DBE240E0"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289130","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-17511","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.387","lastModified":"2026-09-30T16:53:54.353","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition resource dump interface. An attacker with authenticated administrator-level access to the HMC or service processor can obtain a limited snapshot of partition processor state. Successful exploitation results in a confidentiality impact to the managed system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":3.4,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:50:35.938244Z","id":"CVE-2026-17511","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-212"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289132","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18104","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.553","lastModified":"2026-09-29T14:00:07.947","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook (ECB) mode for encryption."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Db2 Mirror for i","cpes":["cpe:2.3:a:ibm:db2_mirror_for_i:7.6:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.5:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.5.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:db2_mirror_for_i:7.4.0:*:*:*:*:*:*:*"],"versions":[{"version":"7.6","status":"affected"},{"version":"7.5","status":"affected"},{"version":"7.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:06.994328Z","id":"CVE-2026-18104","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-327"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:db2_mirror_for_i:*:*:*:*:*:*:*:*","versionStartIncluding":"7.4","versionEndIncluding":"7.6","matchCriteriaId":"E01FA903-74C4-4F19-9DF6-A5AACD6DF475"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289246","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18857","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T14:17:12.680","lastModified":"2026-09-30T16:48:23.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"OPENBMC","cpes":["cpe:2.3:a:ibm:openbmc:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:openbmc:fw1060.81.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L","baseScore":3.4,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":0.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:54:25.176870Z","id":"CVE-2026-18857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289253","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-77797","sourceIdentifier":"cve@rapid7.com","published":"2026-09-24T14:18:17.247","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","packageName":"Velociraptor","platforms":["Windows"],"repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","baseScore":3.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:47:47.888267Z","id":"CVE-2026-77797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-7797/","source":"cve@rapid7.com"},{"url":"https://github.com/Velocidex/go-prefetch/commit/4bae9796298011598d577b125e0b3db3ee03eb74","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-77798","sourceIdentifier":"cve@rapid7.com","published":"2026-09-24T14:18:17.373","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Velociraptor","defaultStatus":"unaffected","packageName":"Velociraptor","platforms":["Linux"],"repo":"https://github.com/Velocidex/velociraptor/","versions":[{"version":"0","lessThan":"0.77.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:48:32.322715Z","id":"CVE-2026-77798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-833"}]}],"references":[{"url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-7798/","source":"cve@rapid7.com"},{"url":"https://github.com/Velocidex/velociraptor/commit/b64d915422da2e8366781bea2b5c5e6808df829c","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-88359","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T14:18:18.320","lastModified":"2026-09-25T17:17:17.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:18:24.616054Z","id":"CVE-2026-88359","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/pantoniou/libfyaml/commit/20502068902d58c076da873117985798df2c7e74","source":"cve@mitre.org"},{"url":"https://github.com/pantoniou/libfyaml/commit/93741a7c9331da9da65ef7a25f2d7d6a817a1c29","source":"cve@mitre.org"},{"url":"https://github.com/pantoniou/libfyaml/issues/315","source":"cve@mitre.org"},{"url":"https://github.com/pantoniou/libfyaml/issues/315","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88360","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T14:18:18.440","lastModified":"2026-10-06T18:16:57.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel data at an address that is not properly aligned for float access. vips_avg_scan() subsequently dereferences the buffer through a float pointer, resulting in undefined behavior and process termination on strict-alignment architectures or UBSan-instrumented builds, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:50:30.333838Z","id":"CVE-2026-88360","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-1339"}]}],"references":[{"url":"https://github.com/libvips/libvips/issues/5187","source":"cve@mitre.org"},{"url":"https://github.com/libvips/libvips/issues/5187","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91187","sourceIdentifier":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","published":"2026-09-24T14:18:18.667","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected.\n\nverify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity.\n\nThis issue affects nimble_zta: from 0.1.2 before 0.1.3."}],"affected":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","affectedData":[{"vendor":"dashbit","product":"nimble_zta","defaultStatus":"unaffected","collectionURL":"https://repo.hex.pm","packageName":"nimble_zta","cpes":["cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"],"modules":["'Elixir.NimbleZTA.Cloudflare'"],"programFiles":["lib/nimble_zta/cloudflare.ex"],"programRoutines":[{"name":"'Elixir.NimbleZTA.Cloudflare':authenticate/3"},{"name":"'Elixir.NimbleZTA.Cloudflare':verify_token/2"}],"repo":"https://github.com/dashbitco/nimble_zta","packageURL":"pkg:hex/nimble_zta","versions":[{"version":"0.1.2","lessThan":"0.1.3","versionType":"semver","status":"affected"}]},{"vendor":"dashbit","product":"nimble_zta","defaultStatus":"unaffected","collectionURL":"https://github.com","packageName":"dashbitco/nimble_zta","cpes":["cpe:2.3:a:dashbit:nimble_zta:*:*:*:*:*:*:*:*"],"modules":["'Elixir.NimbleZTA.Cloudflare'"],"programFiles":["lib/nimble_zta/cloudflare.ex"],"programRoutines":[{"name":"'Elixir.NimbleZTA.Cloudflare':authenticate/3"},{"name":"'Elixir.NimbleZTA.Cloudflare':verify_token/2"}],"repo":"https://github.com/dashbitco/nimble_zta","packageURL":"pkg:github/dashbitco/nimble_zta","versions":[{"version":"bc004b70985ae5763901baab3a4e204047899768","lessThan":"6458fd18a5ba41166d4973214c519e98fe05b72d","versionType":"git","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:43:06.738544Z","id":"CVE-2026-91187","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-91187.html","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/nimble_zta/commit/6458fd18a5ba41166d4973214c519e98fe05b72d","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/nimble_zta/commit/bc004b70985ae5763901baab3a4e204047899768","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://github.com/dashbitco/nimble_zta/security/advisories/GHSA-rj24-g8cc-g7g2","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-91187","source":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}]}},{"cve":{"id":"CVE-2026-95519","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T14:18:20.153","lastModified":"2026-09-25T13:17:23.940","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened, allowing embedded shell commands to run with the privileges of the `rpm` process. Successful exploitation can lead to a full compromise of confidentiality, integrity, and availability for the affected account."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/a:redhat:hummingbird:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T03:55:26.688738Z","id":"CVE-2026-95519","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-95519","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2470977","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-95521","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T14:18:20.290","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. This allows arbitrary command execution as the invoking (typically non-root) user, simply by installing, rebuilding, or otherwise processing an untrusted .src.rpm."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rpm","cpes":["cpe:/a:redhat:hummingbird:1"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:01:31.439999Z","id":"CVE-2026-95521","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-95521","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537812","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-97057","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:21.683","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"NodeRedis","product":"redis-parser","defaultStatus":"unaffected","packageURL":"pkg:npm/redis-parser","versions":[{"version":"0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:31:45.966419Z","id":"CVE-2026-97057","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://github.com/NodeRedis/node-redis-parser","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L108-L122","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L212","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/blob/4c2d31c8717f05dea1ffd91a0e45d68f452c73bd/lib/parser.js#L492-L550","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/issues/47","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NodeRedis/node-redis-parser/issues/65","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/redis-parser-through-3.0.0-denial-of-service-via-invalid-array-length","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97058","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:21.840","lastModified":"2026-10-16T15:10:00.103","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-97059","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:21.997","lastModified":"2026-09-30T21:17:19.180","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"OFFIS","product":"DCMTK","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.7.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T19:38:56.115734Z","id":"CVE-2026-97059","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/DCMTK/dcmtk","source":"disclosure@vulncheck.com"},{"url":"https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360","source":"disclosure@vulncheck.com"},{"url":"https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430","source":"disclosure@vulncheck.com"},{"url":"https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285","source":"disclosure@vulncheck.com"},{"url":"https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1","source":"disclosure@vulncheck.com"},{"url":"https://support.dcmtk.org/redmine/issues/1281","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframes","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97061","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:22.160","lastModified":"2026-09-29T03:17:22.797","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"blackcandy-org","product":"Black Candy","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"3.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:46:16.467057Z","id":"CVE-2026-97061","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/blackcandy-org/blackcandy","source":"disclosure@vulncheck.com"},{"url":"https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search/playlists_controller.rb#L5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/controllers/search_controller.rb#L9","source":"disclosure@vulncheck.com"},{"url":"https://github.com/blackcandy-org/blackcandy/blob/93cfdca9857a5e2ae847469c3238a6174515c76f/app/models/concerns/searchable_concern.rb#L21","source":"disclosure@vulncheck.com"},{"url":"https://github.com/blackcandy-org/blackcandy/issues/463","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/black-candy-through-3.2.1-information-disclosure-via-playlist-search","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97062","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:22.317","lastModified":"2026-10-12T21:17:24.477","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Webkul","product":"Aureus ERP","defaultStatus":"unaffected","repo":"https://github.com/aureuserp/aureuserp","packageURL":"pkg:composer/aureuserp/aureuserp","versions":[{"version":"0","lessThanOrEqual":"1.6.0","versionType":"semver","status":"affected"},{"version":"53ad76dd566f414f1773ec6513616fc2b9e251b5","versionType":"git","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:57:04.998484Z","id":"CVE-2026-97062","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-97062","source":"disclosure@vulncheck.com"},{"url":"https://github.com/aureuserp/aureuserp/pull/1574","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/aureus-erp-stored-xss-via-svg-file-upload","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/stored-xss-via-svg-upload-aureuserp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97359","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:22.533","lastModified":"2026-09-29T03:17:23.087","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rejetto","product":"hfs2","defaultStatus":"unaffected","repo":"https://github.com/rejetto/hfs2","packageURL":"pkg:github/rejetto/hfs2","versions":[{"version":"2.0.0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:44:32.969852Z","id":"CVE-2026-97359","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hfs2-rce-via-multipart-upload-filename-template-injection","source":"disclosure@vulncheck.com"},{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-upload-filename-template-injection/README.md","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97360","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T14:18:22.703","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rejetto","product":"hfs2","defaultStatus":"unaffected","repo":"https://github.com/rejetto/hfs2","packageURL":"pkg:github/rejetto/hfs2","versions":[{"version":"2.0.0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:58:41.458904Z","id":"CVE-2026-97360","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-template-macro-missing-authorization/README.md","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hfs2-unauthenticated-arbitrary-file-read-write-via-template-engine","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-12559","sourceIdentifier":"security@opentext.com","published":"2026-09-24T15:17:18.350","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting confidentiality and integrity of information processed through the application."}],"affected":[{"source":"security@opentext.com","affectedData":[{"vendor":"OpenText","product":"Vendor Invoice Management for SAP Solutions","defaultStatus":"unaffected","modules":["SAP Fiori Capture Validation application"],"platforms":["SAP Fiori"],"versions":[{"version":"VIM 7.6/20.4","lessThanOrEqual":"0009","versionType":"custom","status":"affected"},{"version":"VIM 23.4","lessThanOrEqual":"0004","versionType":"custom","status":"affected"},{"version":"VIM 25.4","lessThanOrEqual":"0001","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security@opentext.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:D/RE:M/U:Red","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"RED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:51:19.732789Z","id":"CVE-2026-12559","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@opentext.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://support.opentext.com/csm?id=kb_article_view&sysparm_article=KB0869040","source":"security@opentext.com"},{"url":"https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869044","source":"security@opentext.com"}]}},{"cve":{"id":"CVE-2026-13465","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:19.117","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:59:23.391487Z","id":"CVE-2026-13465","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-13466","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:19.280","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:59:42.934429Z","id":"CVE-2026-13466","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-131"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-13467","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:19.423","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:00:08.390526Z","id":"CVE-2026-13467","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-18870","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:20.270","lastModified":"2026-09-30T16:00:00.363","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw950.h3.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"},{"version":"FW950.00","lessThanOrEqual":"FW950.H3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:53.685284Z","id":"CVE-2026-18870","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s922_\\(9009-22g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"A7A29250-6BFF-4BFD-8723-A584F5AFDD67"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s922_\\(9009-22g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"95E5E77F-A5BB-46E7-B6B6-B02F242DE829"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h922_\\(9223-22s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"852BF98B-82A6-4A6A-9541-BB65A2CDF650"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h922_\\(9223-22s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E7851003-8D6B-4FE8-87D7-BE968E85E448"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s914_\\(9009-41g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D71B426C-DDDF-4341-9A2E-6A36569A1839"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s914_\\(9009-41g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"003F591A-ACCD-497E-BF8A-DE090321D778"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s924_\\(9009-42g\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"E0EDDB11-824F-4E4E-838C-2A5AE1A79C0C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s924_\\(9009-42g\\):-:*:*:*:*:*:*:*","matchCriteriaId":"4038C5DB-DF9C-4661-9590-F6A0CD4D15D5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_h924_\\(9223-42s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"2A4BBB63-0102-44F0-AF76-4245872B2F89"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_h924_\\(9223-42s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"C2F0E93A-26F0-4914-8A31-3C86E64D5B8A"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e950_\\(9040-mr9\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"D4A756BD-C31D-4457-8B50-305B32E92785"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e950_\\(9040-mr9\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9FF58E5C-0A54-4F2F-A426-0BFD1EACE991"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e980_\\(9080-m9s\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw950.00","versionEndExcluding":"fw950.h4","matchCriteriaId":"52CB0665-0AE6-4A6E-A629-8AB47C7837C5"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e980_\\(9080-m9s\\):-:*:*:*:*:*:*:*","matchCriteriaId":"9BE56BD8-DB0F-4151-9428-42F1B6452D99"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289135","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-19492","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:20.553","lastModified":"2026-09-30T15:40:51.593","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a hypervisor call interface. An attacker with root access to a guest partition can read a limited amount of hypervisor memory, potentially exposing sensitive data belonging to the hypervisor or other guest partitions hosted on the same system, resulting in a confidentiality impact. The attacker has no control over which memory contents are returned. This vulnerability is of particular concern in multi-tenant environments where guests may run arbitrary OS images."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"PowerVM Hypervisor","cpes":["cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1120.01.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1110.31.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.00.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81:*:*:*:*:*:*:*","cpe:2.3:a:ibm:powervm_hypervisor:fw1060.81.0:*:*:*:*:*:*:*"],"versions":[{"version":"FW1120.00","lessThanOrEqual":"FW1120.01","versionType":"semver","status":"affected"},{"version":"FW1110.00","lessThanOrEqual":"FW1110.31","versionType":"semver","status":"affected"},{"version":"FW1060.00","lessThanOrEqual":"FW1060.81","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","baseScore":3.2,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.5,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:50:45.611946Z","id":"CVE-2026-19492","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-457"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"7EA43BB6-6776-4E2F-A279-E30E844EF1C2"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122_\\(9824-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"EC2FA374-2ADB-45C1-ACA1-D39BAD709067"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122_\\(9824-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"96C2DEDC-012D-4B9F-B9DF-344A49B67E46"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"F9475E71-FA18-43A1-902A-2E21C777D254"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1124_\\(9824-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"A66F38F0-55B5-444F-968D-718170852B0A"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1124_\\(9824-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3F51514A-8E29-42D1-B874-838F8A0869D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"D11BE622-6276-49D9-B394-EB615E3C5BFD"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1122s_\\(9824-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"E9E20EAA-BBEE-4924-9BBA-07D6DE018509"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1122s_\\(9824-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"26E1E16B-8F95-46EC-BAA0-0A53F332292B"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"B7048C65-6872-4F5B-9691-D74E269E1CF9"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1114_\\(9824-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"96EEE277-E80A-4380-A4C4-9E2CCF6E8C52"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1114_\\(9824-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8688E552-BE38-4EB9-8514-D7060C548C39"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"BB22063C-C9A0-4D69-95FC-3B19ACDC6B21"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1122_\\(9856-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"76154775-CAE7-43F1-A14D-CA092F5539D1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1122_\\(9856-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3C8998E4-5EA9-4C7E-BF59-644CB78D00D2"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"82AEF0FF-068C-4123-BEFB-7D3584F1B15A"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1124_\\(9856-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"82BC7AD7-3F24-4EE7-9360-4024A6CC319C"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1124_\\(9856-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"3FB6FA2C-70A5-4F19-B64B-7502D20CFE5C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"57896A45-2625-4C51-9B3E-5B934979FA33"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1150_\\(9043-mru\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"4AB43439-0F5B-4839-A109-E14E726CAD27"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1150_\\(9043-mru\\):-:*:*:*:*:*:*:*","matchCriteriaId":"AC9D9EFF-1E92-4894-9976-001227F78869"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"F95F4E4A-7374-40FB-AC3B-AEF7AE607CEF"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B3F5100A-FE2A-412C-9B57-B616B97B1142"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1112_\\(9242-21t\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"D79F90A7-5929-4893-BC72-4CF11BDB4F9D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1112_\\(9242-21t\\):-:*:*:*:*:*:*:*","matchCriteriaId":"EA825307-2083-4264-8E8B-798661285261"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1080_\\(9080-hex\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1681A01A-7020-427B-848A-6E3CC0FE1E5F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1080_\\(9080-hex\\):-:*:*:*:*:*:*:*","matchCriteriaId":"DF85251B-E02C-4293-98F0-D331BF51CAC4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022_\\(9105-22a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"8E228E48-523F-4486-8A29-5DB61851B1F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022_\\(9105-22a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E3E15C41-9CBD-4F66-A176-07B3E9BBD81D"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1024_\\(9105-42a\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"38AE73EA-12AE-4E46-8435-259AD1773403"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1024_\\(9105-42a\\):-:*:*:*:*:*:*:*","matchCriteriaId":"E49EE658-B8AE-48F7-A765-92BA3A630AA0"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1022s_\\(9105-22b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"DD0351D8-3E79-4A28-BC5E-ADD9551238BB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1022s_\\(9105-22b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"564A665A-7B94-40CE-A4D9-CDD0CCF52B2E"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1014_\\(9105-41b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"C5578070-8EEC-4A76-A07F-5094DCF69A49"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1014_\\(9105-41b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"ECD54B80-5754-4C19-AE0C-F539DEF96DCB"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1022_\\(9786-22h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7097B3B4-A5BF-4B60-8FAA-6D8D4BA1A44E"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1022_\\(9786-22h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"B2C09090-C18F-464A-8DEF-E23B5990E2A4"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_l1024_\\(9786-42h\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"1E9CBB70-ACFC-4904-8CFB-16D3672FE3CA"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_l1024_\\(9786-42h\\):-:*:*:*:*:*:*:*","matchCriteriaId":"0170400B-89A7-4B44-9AA7-9A168C9CAE9C"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1050_\\(9043-mrx\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"CA91958A-CDF9-4360-8886-00E38A8B7366"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1050_\\(9043-mrx\\):-:*:*:*:*:*:*:*","matchCriteriaId":"061D193E-84BC-4DE7-96C4-B75D11769ED5"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_s1012_\\(9028-21b\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1060.00","versionEndExcluding":"fw1060.82","matchCriteriaId":"7F1D438E-4AFC-4BAC-AD5B-B6152FFEA821"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_s1012_\\(9028-21b\\):-:*:*:*:*:*:*:*","matchCriteriaId":"7BED85F2-8CCB-417C-A739-23828966A036"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1110.00","versionEndExcluding":"fw1110.32","matchCriteriaId":"6A492561-E2C8-4EAE-8D31-F20DA413BABC"},{"vulnerable":true,"criteria":"cpe:2.3:o:ibm:power_system_e1180_\\(9080-heu\\)_firmware:*:*:*:*:*:*:*:*","versionStartIncluding":"fw1120.00","versionEndExcluding":"fw1120.02","matchCriteriaId":"90F8D763-A95F-4189-82DB-1DD6B134D244"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:ibm:power_system_e1180_\\(9080-heu\\):-:*:*:*:*:*:*:*","matchCriteriaId":"8BD4FC49-8120-4D4B-906A-1B6FA6B30FA2"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289137","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-51994","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:22.947","lastModified":"2026-09-25T19:17:26.853","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:11:53.566976Z","id":"CVE-2026-51994","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security#readme","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-01-resource-metadata-ssrf.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51995","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:23.087","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:57:59.281035Z","id":"CVE-2026-51995","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security#readme","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-02-authorization-server-ssrf.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51996","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:23.280","lastModified":"2026-09-29T16:17:08.197","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:22:07.273180Z","id":"CVE-2026-51996","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-328"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-04-md5-token-isolation.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-51997","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:23.397","lastModified":"2026-09-25T17:17:09.083","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:30:01.121484Z","id":"CVE-2026-51997","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-08-browser-url-validation.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-52001","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:23.520","lastModified":"2026-10-06T18:16:55.273","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit fetch wrapper \" src/lib/utils.ts"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:46:05.813178Z","id":"CVE-2026-52001","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/geelen/mcp-remote","source":"cve@mitre.org"},{"url":"https://github.com/geelen/mcp-remote/security/advisories","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security#readme","source":"cve@mitre.org"},{"url":"https://github.com/playb0t/mcp-remote-oauth-security/blob/v1.0.1/advisories/F-11-sse-token-origin-scope.md","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-56736","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T15:17:24.100","lastModified":"2026-09-24T15:17:24.240","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any unauthenticated user (or low-privileged registered user) to inject arbitrary JavaScript that executes in an administrator's browser when they review or edit a user-submitted FAQ entry. This leads to admin account takeover via session theft. The vulnerability exists because `html_entity_decode()` converts HTML entities into executable HTML after `strip_tags()` has already passed them through, and the admin template renders the content with Twig's `|raw` filter without any output sanitization. Version 4.2.0-alpha fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":"< 4.2.0-alpha","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:51:56.083267Z","id":"CVE-2026-56736","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgwp-vc7q-cvj3","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pgwp-vc7q-cvj3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-58004","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:24.610","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:00:27.350128Z","id":"CVE-2026-58004","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-58005","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:24.750","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:00:45.663087Z","id":"CVE-2026-58005","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-119"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-58006","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:24.890","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:01:00.684169Z","id":"CVE-2026-58006","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-58007","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:25.027","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Untrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:01:18.588125Z","id":"CVE-2026-58007","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-58008","sourceIdentifier":"04c0172e-9735-4a9d-a92a-fe01fa863447","published":"2026-09-24T15:17:25.163","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections.\n\nThis issue affects Trusted Firmware: through socfpga_v2.14.0."}],"affected":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","affectedData":[{"vendor":"Altera","product":"Trusted Firmware","defaultStatus":"unaffected","platforms":["ARM"],"versions":[{"version":"0","lessThanOrEqual":"socfpga_v2.14.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:01:39.463181Z","id":"CVE-2026-58008","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"04c0172e-9735-4a9d-a92a-fe01fa863447","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://www.altera.com/product-security/advisory/asa-0006","source":"04c0172e-9735-4a9d-a92a-fe01fa863447"}]}},{"cve":{"id":"CVE-2026-65422","sourceIdentifier":"security@genetec.com","published":"2026-09-24T15:17:27.960","lastModified":"2026-09-24T19:37:47.987","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails."}],"affected":[{"source":"security@genetec.com","affectedData":[{"vendor":"Genetec Inc.","product":"Genetec Security Center","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"<5.12.2.22","versionType":"semver","status":"affected"},{"version":">=5.12.2.22","versionType":"semver","status":"unaffected"},{"version":"<5.13.3.9","versionType":"semver","status":"affected"},{"version":">=5.13.3.9","versionType":"semver","status":"unaffected"},{"version":"<5.14.1.2","versionType":"semver","status":"affected"},{"version":">=5.14.1.2","versionType":"semver","status":"unaffected"},{"version":">=5.14.2.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@genetec.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:54:16.470446Z","id":"CVE-2026-65422","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@genetec.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://techdocs.genetec.com/r/en-US/Security-Updates-for-Security-Center-5.14/Resolved-vulnerabilities-in-Security-Center-5.14.1.2","source":"security@genetec.com"}]}},{"cve":{"id":"CVE-2026-6544","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:30.890","lastModified":"2026-09-28T20:48:40.993","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Concert","cpes":["cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:concert:3.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"3.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:49:31.088220Z","id":"CVE-2026-6544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-552"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*","versionStartIncluding":"1.0.0","versionEndIncluding":"3.0.0","matchCriteriaId":"F935EDBC-29BC-4CEB-8149-DD294B37307D"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*","matchCriteriaId":"703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288830","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73064","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:34.273","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"trustedfirmware","product":"Mbed TLS","defaultStatus":"unaffected","repo":"https://github.com/Mbed-TLS/mbedtls","versions":[{"version":"3.2.0","lessThan":"3.6.7","versionType":"semver","status":"affected"},{"version":"4.0.0","lessThan":"4.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":2.9,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.4,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:00:13.513498Z","id":"CVE-2026-73064","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-394"}]}],"references":[{"url":"https://github.com/Mbed-TLS/mbedtls","source":"cve@mitre.org"},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-77703","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T15:17:37.800","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM).\n\nThis issue affects Liman Render Engine: from 1.0 before 1.2-75."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"HAVELSAN Inc.","product":"Liman Render Engine","defaultStatus":"unaffected","versions":[{"version":"1.0","lessThan":"1.2-75","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:53:46.625817Z","id":"CVE-2026-77703","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Primary","description":[{"lang":"en","value":"CWE-322"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1172","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-77707","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-24T15:17:37.947","lastModified":"2026-09-24T19:36:51.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM).\n\nThis issue affects Liman Render Engine: from 1.0 before 1.2-75."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"HAVELSAN Inc.","product":"Liman Render Engine","defaultStatus":"unaffected","versions":[{"version":"1.0","lessThan":"1.2-75","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:58:34.805701Z","id":"CVE-2026-77707","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Primary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1172","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-77825","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:38.560","lastModified":"2026-09-29T13:26:00.887","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`). The path confinement check uses `str.startswith()` rather than proper boundary validation, allowing an authenticated admin to read `.log`, `.jsonl`, and `.json` files outside the configured `LOG_FOLDER` by supplying a filename that resolves into a sibling directory whose absolute path shares the log directory's string prefix."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"ContextForge MCP Gateway","cpes":["cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.0:*:*:*:*:*:*:*","cpe:2.3:a:ibm:contextforge_mcp_gateway:1.0.8:*:*:*:*:*:*:*"],"versions":[{"version":"1.0.0","lessThanOrEqual":"1.0.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","baseScore":4.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:15.788728Z","id":"CVE-2026-77825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:contextforge:*:*:*:*:*:python:*:*","versionStartIncluding":"1.0.0","versionEndExcluding":"1.0.9","matchCriteriaId":"0E3A0CD6-073C-41C6-BCED-745C13F56E6F"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289314","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-77874","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:38.700","lastModified":"2026-09-24T19:41:16.513","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Enterprise Build of Quarkus","cpes":["cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.27.5.sp1:sp1:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:enterprise_build_of_quarkus:3.33.3.sp1:sp1:*:*:*:*:*:*"],"versions":[{"version":"3.27.1","lessThanOrEqual":"3.27.5.SP1","versionType":"semver","status":"affected"},{"version":"3.33.1","lessThanOrEqual":"3.33.3.SP1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:50:50.894476Z","id":"CVE-2026-77874","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7289050","source":"psirt@us.ibm.com"}]}},{"cve":{"id":"CVE-2026-81539","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.377","lastModified":"2026-10-06T16:13:00.500","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:47.193272Z","id":"CVE-2026-81539","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81545","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.517","lastModified":"2026-10-06T16:12:58.357","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:29.473881Z","id":"CVE-2026-81545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81547","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.650","lastModified":"2026-10-06T16:12:56.070","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:48:38.039296Z","id":"CVE-2026-81547","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81548","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.770","lastModified":"2026-10-06T16:20:11.740","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:22.446545Z","id":"CVE-2026-81548","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81549","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:39.897","lastModified":"2026-10-06T16:19:54.677","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:20:22.120549Z","id":"CVE-2026-81549","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-81552","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:40.020","lastModified":"2026-10-06T16:16:11.680","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:52:39.611498Z","id":"CVE-2026-81552","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-82093","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:40.733","lastModified":"2026-10-06T16:15:46.710","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:54:51.145401Z","id":"CVE-2026-82093","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Primary","description":[{"lang":"en","value":"CWE-502"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-82094","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-24T15:17:40.870","lastModified":"2026-10-06T16:15:27.447","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to traverse directories on the system due to improper limitation of a pathname to a restricted directory."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"DataStage on Cloud Pak for Data","cpes":["cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*"],"versions":[{"version":"5.4.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":4.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:47:12.811707Z","id":"CVE-2026-82094","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0:*:*:*:*:*:*:*","matchCriteriaId":"99B4B98D-C084-4700-8A44-E6FFA70C5C51"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288649","source":"psirt@us.ibm.com","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-88351","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:50.423","lastModified":"2026-09-25T18:17:31.257","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:09:19.298466Z","id":"CVE-2026-88351","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","source":"cve@mitre.org"},{"url":"https://github.com/ludocode/mpack/issues/123","source":"cve@mitre.org"},{"url":"https://github.com/ludocode/mpack/issues/123","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-90481","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:17:51.760","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"PortSwigger","product":"Burp Suite DAST","defaultStatus":"unaffected","versions":[{"version":"2021.11","lessThan":"2026.8","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:55:22.193962Z","id":"CVE-2026-90481","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Primary","description":[{"lang":"en","value":"CWE-288"}]}],"references":[{"url":"https://portswigger.net/burp/releases/dast-2026-8","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-90959","sourceIdentifier":"secalert@redhat.com","published":"2026-09-24T15:17:53.540","lastModified":"2026-10-21T19:17:04.337","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects URLs beginning with 'file://', but Python's URL parser recognizes the 'file:' scheme without double slashes, creating a mismatch between what is validated and what is dispatched to the file downloader. An authenticated user with low-privilege repository permissions can supply a specially crafted URL using relative path traversal sequences to read any file accessible to the Pulp server process. In deployments that include Pulp Container, successful exploitation allows an attacker to read the container registry token signing private key and forge bearer tokens, granting unauthorized access to all private container repositories in the affected registry."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"],"versions":[{"version":"0:3.49.71-1.el9ap","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-26/hub-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"],"versions":[{"version":"1791947385","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"ansible-automation-platform-27/hub-rhel9","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"],"versions":[{"version":"1792388670","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-24/hub-rhel8","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-automation-platform-25/hub-rhel8","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pulpcore-selinux","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.11-pulpcore","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3x-pulpcore","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","cpes":["cpe:/a:redhat:ansible_automation_platform:2"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pulpcore-obsolete-packages","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pulpcore-selinux","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python3.12-pulpcore","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rubygem-pulpcore_client","cpes":["cpe:/a:redhat:satellite:6"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 4 for Cloud Providers","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"pulpcore-selinux","cpes":["cpe:/a:redhat:rhui:4::el8"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 4 for Cloud Providers","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore","cpes":["cpe:/a:redhat:rhui:4::el8"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 4 for Cloud Providers","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore-client","cpes":["cpe:/a:redhat:rhui:4::el8"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"python-pulpcore-client","cpes":["cpe:/a:redhat:rhui:5::el9"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/rhua-rhel9","cpes":["cpe:/a:redhat:rhui:5::el9"]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhui5/rhua-tp-rhel9","cpes":["cpe:/a:redhat:rhui:5::el9"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:47:33.555341Z","id":"CVE-2026-90959","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:87004","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:87120","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:87124","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-90959","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2533037","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-97224","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T15:18:01.227","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was detected in Excalidraw up to 0.18.1. The impacted element is an unknown function of the file packages/excalidraw/data/restore.ts of the component Imported File Handler. Performing a manipulation of the argument customData.generationData.html results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Excalidraw","cpes":["cpe:2.3:a:excalidraw:excalidraw:*:*:*:*:*:*:*:*"],"modules":["Imported File Handler"],"versions":[{"version":"0.18.0","status":"affected"},{"version":"0.18.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:31:36.209421Z","id":"CVE-2026-97224","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97224","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/907811","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409318","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409318/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97362","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T15:18:01.393","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"disclosure@vulncheck.com","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and persistent loss of availability by sending a single crafted request. Attackers can trigger a hung serving thread that enters a busy loop, rendering the entire file server unresponsive to all clients without self-recovery until an operator manually restarts the service."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"rejetto","product":"hfs2","defaultStatus":"unaffected","repo":"https://github.com/rejetto/hfs2","packageURL":"pkg:github/rejetto/hfs2","versions":[{"version":"2.0.0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:32:26.283903Z","id":"CVE-2026-97362","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-835"}]}],"references":[{"url":"https://github.com/wgetnz/hfs2/blob/master/advisories/hfs2-getini-infinite-loop-dos/README.md","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/hfs2-unauthenticated-denial-of-service-via-hung-serving-thread","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-97404","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T15:18:01.537","lastModified":"2026-09-26T23:16:43.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"OpenStack","product":"Zaqar","defaultStatus":"unaffected","repo":"https://opendev.org/openstack/zaqar","versions":[{"version":"1.0.0","lessThan":"20.1.2","versionType":"semver","status":"affected"},{"version":"21.0.0","lessThan":"21.0.2","versionType":"semver","status":"affected"},{"version":"22.0.0","lessThan":"22.0.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:41.633493Z","id":"CVE-2026-97404","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"references":[{"url":"https://launchpad.net/bugs/2164987","source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/6","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2025-32000","sourceIdentifier":"psirt@hcl.com","published":"2026-09-24T16:17:06.087","lastModified":"2026-10-14T13:10:00.187","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability."},{"lang":"es","value":"HCL Sametime es vulnerable a la sanitización de entrada insuficiente. La aplicación no sanitizaba adecuadamente la entrada del usuario. Cuando la entrada del usuario se confía implícita o explícitamente sin suficiente sanitización, actores maliciosos pueden explotar esta vulnerabilidad."}],"affected":[{"source":"psirt@hcl.com","affectedData":[{"vendor":"HCL Software","product":"HCL Sametime","defaultStatus":"unaffected","versions":[{"version":"12.0.33 and older","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@hcl.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:35:48.370418Z","id":"CVE-2025-32000","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@hcl.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132652","source":"psirt@hcl.com"}]}},{"cve":{"id":"CVE-2026-56737","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:07.637","lastModified":"2026-09-29T03:17:16.310","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":">= 3.2.0, < 4.1.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:47:07.965759Z","id":"CVE-2026-56737","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/commit/410208b90f1d01534812ac5203d3e8d9c7bd591f","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/commit/5097dff341fb01e93e8561e7261b3ae657df715a","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/commit/6a69f6e2142fde722165c65b7e0a49f3176e87be","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8gpw-xvpf-hvx5","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8gpw-xvpf-hvx5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-56739","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:07.803","lastModified":"2026-09-28T21:17:18.067","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.43.0, Logto fetches administrator-controlled outbound destinations without validating the address used for the connection. Webhook delivery in packages/core/src/libraries/hook/utils.ts can reach special-use and cloud metadata addresses. Custom OAuth2 connectors can use an attacker-selected userInfoEndpoint and forward the OAuth access token in the Authorization header, while OIDC connectors can fetch an attacker-selected jwksUri. The affected operations require tenant administrative configuration access, but they cross the server's network boundary and can expose internal data or upstream provider credentials. This issue is fixed in version 1.43.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"logto-io","product":"logto","versions":[{"version":"< 1.43.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T20:11:08.681205Z","id":"CVE-2026-56739","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/logto-io/logto/commit/16f4b2e732d5114ac98646c9370ec6ab61d6ed26","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/pull/9501","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.43.0","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/security/advisories/GHSA-3556-624q-c5w3","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-63203","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:08.700","lastModified":"2026-09-24T16:17:08.837","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary. Exploitation requires federated token-set storage to be enabled and the affected user to have authenticated through a supported connector. A low-trust application can use the disclosed provider token against upstream APIs within that token's granted scopes. This issue is fixed in version 1.42.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"logto-io","product":"logto","versions":[{"version":">= 1.31.0, < 1.42.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:47:15.549514Z","id":"CVE-2026-63203","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/logto-io/logto/commit/b560d17a4da4c25da95e3c73af4485d18ab7c224","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/pull/9116","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/releases/tag/v1.42.0","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf","source":"security-advisories@github.com"},{"url":"https://github.com/logto-io/logto/security/advisories/GHSA-6g9q-qrx7-3jxf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-63630","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:08.873","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"alam00000","product":"bentopdf","versions":[{"version":"< 2.8.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N","baseScore":3.4,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:48:51.526364Z","id":"CVE-2026-63630","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/alam00000/bentopdf/commit/b21f602cca972320bfffbf72e37df535313a6e48","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/releases/tag/v2.8.7","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-67233","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:09.520","lastModified":"2026-10-19T19:36:12.260","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2 delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring tag. But allowed_methods includes DELETE, and delete_resource/2 deletes / restarts shovel runtime parameters with no additional role check. A monitoring user , intended to have read-only visibility , can therefore delete or restart any shovel in any vhost they can see. A read-only monitoring user can delete or restart any dynamic shovel , a state-changing operation that the equivalent /api/parameters endpoint correctly restricts to policymaker. Preconditions include rabbitmq_shovel + rabbitmq_shovel_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rabbitmq","product":"rabbitmq-server","versions":[{"version":">= 3.13.0, < 3.13.15","status":"affected"},{"version":">= 4.0.0, < 4.0.20","status":"affected"},{"version":">= 4.1.0, < 4.1.11","status":"affected"},{"version":">= 4.2.0, < 4.2.6","status":"affected"},{"version":">= 4.3.0, < 4.3.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:12.181651Z","id":"CVE-2026-67233","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"3.13.0","versionEndExcluding":"3.13.15","matchCriteriaId":"603E40A7-6B53-47D4-A522-17B013CE7607"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.20","matchCriteriaId":"9B5D0326-EB2B-40B8-98BD-ECE547F96DA4"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.11","matchCriteriaId":"01F24286-9982-4592-A370-70E55D6572D5"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.6","matchCriteriaId":"7179C053-B8C1-4B72-83EB-456125ED1AAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.1","matchCriteriaId":"41410FDE-4B5E-4466-B7C4-A62FEBFA0C80"}]}]}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7jc3-73v6-rjvc","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-75907","sourceIdentifier":"cret@cert.org","published":"2026-09-24T16:17:10.387","lastModified":"2026-09-28T16:31:16.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying."}],"affected":[{"source":"cret@cert.org","affectedData":[{"vendor":"Norwegian Cruise Line","product":"door access control","versions":[{"version":"N/A","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:01:05.357661Z","id":"CVE-2026-75907","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-294"},{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://kb.cert.org/vuls/id/676317","source":"cret@cert.org"},{"url":"https://www.kb.cert.org/vuls/id/676317","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-76907","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:10.500","lastModified":"2026-10-05T16:17:16.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public document UUID. An unauthenticated caller can submit an empty search query and iterate predictable path values to enumerate public document subtrees, obtaining document identifiers, titles, creator data, timestamps, and tree metadata. Each disclosed identifier can then be used through normal public-document endpoints to retrieve the document content, and differing 403 Forbidden and 404 Not Found responses reveal whether a guessed path exists. Authenticated users can similarly discover documents with authenticated link reach, while restricted documents remain protected. This issue is fixed in version 5.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"suitenumerique","product":"docs","versions":[{"version":">= 4.8.2, < 5.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:51:06.072038Z","id":"CVE-2026-76907","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/suitenumerique/docs/commit/9ef4a15f5e7437c73ad04d2115a15dba3ffb7a76","source":"security-advisories@github.com"},{"url":"https://github.com/suitenumerique/docs/releases/tag/v5.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/suitenumerique/docs/security/advisories/GHSA-p8v2-wjj3-3j9w","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-77581","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:10.943","lastModified":"2026-09-29T19:07:47.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution used by fetch(targetUrl), allowing an attacker-controlled hostname to resolve to an internal or reserved destination after validation. A certificate-like path can satisfy ALLOWED_PATH_PATTERNS, and direct clients can forge the browser-oriented Origin header. Deployments without PROXY_SECRET skip the optional signature check, while the signature is an anti-abuse measure rather than a destination-security boundary. The proxy has a 10 MB response limit and can relay response bodies from reachable destinations. The advisory identifies both the official Worker deployment and self-hosted instances as impacted where the Worker execution environment can reach internal or reserved destinations. This vulnerability is fixed in 2.8.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"alam00000","product":"bentopdf","versions":[{"version":"< 2.8.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:37:09.697885Z","id":"CVE-2026-77581","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/alam00000/bentopdf/commit/45496fcd2ed6e02dcdde0d3839cc5024c091760c","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/commit/58cd1a8893bfe06e4a59a72adc2e7db00a8b9266","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/releases/tag/v2.8.7","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-5xjf-rr5x-pcfj","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-5xjf-rr5x-pcfj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79758","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:11.107","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET /status/:id accepts an attacker-supplied numeric host identifier, and POST /clear-connections permits a regular user to clear the global SSH connection pool. The affected src/backend/ssh/server-stats.ts routes expose host online or offline state and lastChecked timestamps and can disrupt other users' active sessions or pooled connections. Unauthenticated requests remain blocked, but authentication alone does not preserve tenant isolation. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 1.8.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:20:25.319540Z","id":"CVE-2026-79758","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-372w-6f3h-vcm4","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-372w-6f3h-vcm4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79759","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:11.283","lastModified":"2026-09-29T03:17:18.063","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credentialId and targetHostId integer values without checking that either record belongs to the requesting user. In src/backend/database/routes/credentials.ts, differential errors reveal whether credential and host records exist and disclose each record's authType value. Properly encrypted passwords and keys are not disclosed, but a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 1.7.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:50:06.888547Z","id":"CVE-2026-79759","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/b0598294a6aeed866f51ce58067f43c1d751c7a6","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-w4cf-69fj-g96f","source":"security-advisories@github.com"},{"url":"https://github.com/alam00000/bentopdf/security/advisories/GHSA-cx8x-7rrr-r9x8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79760","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:11.490","lastModified":"2026-09-28T16:17:15.077","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, Termix allows authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests through the notification-channel test endpoint. The request path in src/backend/database/routes/alert-rules-routes.ts reaches src/backend/utils/notification-sender.ts without destination allowlisting or private-address blocking. This permits blind requests to internal HTTP services reachable by the Termix server. Webhook mode also permits attacker-controlled HTTP methods and headers, which can cause limited state changes when an internal service accepts the fixed notification body, although response bodies are not returned. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 2.5.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:43:26.193088Z","id":"CVE-2026-79760","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/e1d1a3e53d65794ec2f23099bafe77fdfdd11648","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-6hx3-9mgq-h9fj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-79761","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:11.743","lastModified":"2026-10-05T16:17:16.427","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Termix SSH key deployment flow derives a grep pattern from a user-controlled public-key token and interpolates it into double-quoted shell commands executed on the selected target host. In src/backend/database/routes/credential-deploy-routes.ts, both grep -F verification paths accept command substitution or quote-breaking shell syntax in keyPattern. An authenticated user who can deploy a crafted SSH credential can therefore execute commands with the selected remote account's privileges. The separate ACME command-injection report is outside this CVE's scope. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 1.7.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","baseScore":6.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.3,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:10.792630Z","id":"CVE-2026-79761","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/fafff94e5e31c3843df06aa08773bbaa879bbede","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-p2g3-2xq3-23gx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-88355","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:12.833","lastModified":"2026-10-06T18:16:57.013","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the returned allocation as a complete te_expr object. This results in undefined behavior and can cause deterministic process termination in UBSan-instrumented builds."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:44:34.584065Z","id":"CVE-2026-88355","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-131"}]}],"references":[{"url":"https://github.com/codeplea/tinyexpr/issues/145","source":"cve@mitre.org"},{"url":"https://github.com/szaydel/tinyexpr/commit/fe7459728c2ab8d2f91365abe56601cdd0e24f9b","source":"cve@mitre.org"},{"url":"https://github.com/codeplea/tinyexpr/issues/145","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88357","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:12.957","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks. This results in undefined behavior and can cause process termination in UBSan-instrumented builds or on strict-alignment architectures, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:52:11.193406Z","id":"CVE-2026-88357","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-1335"}]}],"references":[{"url":"https://github.com/ntop/nDPI/issues/3213","source":"cve@mitre.org"},{"url":"https://github.com/ntop/nDPI/pull/3231","source":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/6698f14bf6025394a537fe23f413cf79e9d13594","source":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f","source":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e","source":"cve@mitre.org"},{"url":"https://github.com/utoni/nDPI/commit/8fc3b439920021a77165f8aee4f81b25bc88629e","source":"cve@mitre.org"},{"url":"https://github.com/ntop/nDPI/issues/3213","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88358","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.090","lastModified":"2026-09-29T03:17:19.610","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted. This results in a heap out-of-bounds read and may cause application termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:25:09.093346Z","id":"CVE-2026-88358","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/simdjson/simdjson/commit/20b28712ffce8320237b75a587d35a2e89140577","source":"cve@mitre.org"},{"url":"https://github.com/simdjson/simdjson/issues/2815","source":"cve@mitre.org"},{"url":"https://github.com/simdjson/simdjson/pull/2817","source":"cve@mitre.org"},{"url":"https://github.com/simdjson/simdjson/issues/2815","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88361","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.217","lastModified":"2026-09-25T18:17:31.423","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:05:40.308342Z","id":"CVE-2026-88361","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/chenjiefeng2001/sumatrapdf_folked/commit/b22a8c71ddc9de80ece5f88d14b434c20fee912e","source":"cve@mitre.org"},{"url":"https://github.com/haimag/sumatrapdf/commit/8b999ff1bf0a8df244e75440682a3fd9a038eb2d","source":"cve@mitre.org"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/issues/5952","source":"cve@mitre.org"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/issues/5952","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88362","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.350","lastModified":"2026-09-25T17:17:17.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:15:23.278438Z","id":"CVE-2026-88362","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709636","source":"cve@mitre.org"},{"url":"https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mujs.git/commit/?id=8a32c397b28fe45747ac4e9e4f3dca049825eda7","source":"cve@mitre.org"},{"url":"https://bugs.ghostscript.com/show_bug.cgi?id=709636","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88365","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.483","lastModified":"2026-09-29T03:17:20.747","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:27:31.703206Z","id":"CVE-2026-88365","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/lieff/minimp3/issues/151","source":"cve@mitre.org"},{"url":"https://github.com/lieff/minimp3/issues/151","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88366","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.607","lastModified":"2026-10-06T18:16:57.353","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle. The function subsequently converts this NaN value to int without validating that it is finite and representable, resulting in undefined behavior and process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:43:32.241424Z","id":"CVE-2026-88366","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/memononen/nanosvg/issues/294","source":"cve@mitre.org"},{"url":"https://github.com/memononen/nanosvg/issues/294","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88368","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.730","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. The rasterizer subsequently converts these values to int without range validation, resulting in undefined behavior and possible process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:54:43.282407Z","id":"CVE-2026-88368","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/memononen/nanosvg/issues/292","source":"cve@mitre.org"},{"url":"https://github.com/memononen/nanosvg/issues/292","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88369","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.850","lastModified":"2026-09-25T18:17:31.773","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump()."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T18:00:10.265493Z","id":"CVE-2026-88369","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/zserge/jsmn/issues/249","source":"cve@mitre.org"},{"url":"https://github.com/zserge/jsmn/issues/249","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88370","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:13.977","lastModified":"2026-09-25T16:17:29.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length], requiring an additional writable byte. Applications using the bundled allocation pattern can trigger deterministic heap memory corruption when processing any non-empty INI input, resulting in denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:31:19.915848Z","id":"CVE-2026-88370","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/madmurphy/libconfini/issues/20","source":"cve@mitre.org"},{"url":"https://github.com/madmurphy/libconfini/issues/20","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88371","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T16:17:14.100","lastModified":"2026-10-06T18:16:57.523","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code 128 input, decode_e() can return -1 for an invalid edge pattern, and decode6() subsequently left-shifts this negative signed value while constructing the edge signature. The operation invokes undefined behavior and can terminate trap-mode UBSan builds with SIGILL, resulting in denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:41:48.800706Z","id":"CVE-2026-88371","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-682"}]}],"references":[{"url":"https://github.com/mchehab/zbar/issues/336","source":"cve@mitre.org"},{"url":"https://github.com/mchehab/zbar/issues/336","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-92680","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","published":"2026-09-24T16:17:14.357","lastModified":"2026-09-26T23:16:39.217","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target user has stored in Merge."}],"affected":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","affectedData":[{"vendor":"Araxis","product":"Merge","defaultStatus":"unknown","versions":[{"version":"2011.4074","lessThan":"2026.1","versionType":"custom","status":"affected"},{"version":"2026.1","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","ssvcData":{"timestamp":"2026-09-16T17:36:45.331736Z","id":"CVE-2026-92680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:40:54.710486Z","id":"CVE-2026-92680","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9119a7d8-5eab-497f-8521-727c672e3725","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/grepstrength/CVE-2026-92680","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://grepstrength.com/research/araxis-merge","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-267-01.json","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.araxis.com/merge/release-notes-2026#Merge-SA-26-00","source":"9119a7d8-5eab-497f-8521-727c672e3725"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92680","source":"9119a7d8-5eab-497f-8521-727c672e3725"}]}},{"cve":{"id":"CVE-2026-93205","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:14.523","lastModified":"2026-10-21T13:21:04.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/arm-smmu-v3: Manage teardown with devm\n\narm_smmu_device_remove() manually frees the IOPF queue, destroys the\nvmid_map and disables the device, while the IRQs and queues are devm\nmanaged. devm unwinds only after remove() returns, so the cleanup runs\nin the wrong order. The IOPF queue is freed before the event-queue IRQ\nwhose handler uses it.\n\nManage all of it with devm so the unwind order is correct. Free the IOPF\nqueue and vmid_map via devm actions, and disable the device from one\nregistered after arm_smmu_device_reset().\n\nThis is also a prerequisite for fixing a Tegra241 CMDQV CMD_SYNC\nuse-after-free in the subsequent patch."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"64b1a9384db9cabf1bde378a2d5c1923fd67ea0d","versionType":"git","status":"affected"},{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"981686f4137760a16a03c5193f11d85133533f93","versionType":"git","status":"affected"},{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"2235eafda9b3df9295efd0593cd4a8977440c3f6","versionType":"git","status":"affected"},{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"78fd5a2d65f3546cb4285f8e52f445baecbd00e0","versionType":"git","status":"affected"},{"version":"395ad89d11fd93f79a6b942e91fc409807a63c4b","lessThan":"2bd22a0d40503a65d243b011de146603c8ce1cbc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2235eafda9b3df9295efd0593cd4a8977440c3f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bd22a0d40503a65d243b011de146603c8ce1cbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64b1a9384db9cabf1bde378a2d5c1923fd67ea0d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78fd5a2d65f3546cb4285f8e52f445baecbd00e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/981686f4137760a16a03c5193f11d85133533f93","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93206","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:14.670","lastModified":"2026-10-19T10:17:11.367","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/proc: Use file_ns_capable() when checking config space read access\n\nproc_bus_pci_read() decides how much of the config space is readable based\non capable(CAP_SYS_ADMIN), which checks the credentials of the task calling\nread(), not the credentials of the process that opened the file.\n\nThe sysfs equivalent, pci_read_config(), has checked the credentials of the\nopening process since commit de139a339395 (\"pci: check caps from sysfs file\nopen to read device dependent config space\"), so a privileged process can\nopen the config space file and pass the file descriptor to an unprivileged\nprocess (for example, a process running a KVM guest with an assigned\ndevice), which can then read the entire config space.  The check was\nsubsequently routed through the LSM framework in commit 47970b1b2aa6 (\"pci:\nuse security_capable() when checking capablities during config space read\")\nand converted to the dedicated helper in commit ab0fa82b2df9 (\"pci-sysfs:\nuse proper file capability helper function\").\n\nThus, the two interfaces check the same capability against different\ncredentials.  Checking the credentials of the task calling read() makes the\noutcome depend on who reads rather than who opened, so the restriction is\nbypassed whenever a more privileged process reads through the descriptor.\nChecking the credentials recorded in file->f_cred settles the decision at\nopen() time and ties it to the file, where it cannot change with the\ncaller.\n\nUse file_ns_capable() to check CAP_SYS_ADMIN against the credentials in\neffect when the file was opened, bringing the procfs interface in line with\nthe sysfs behaviour.\n\nAs a result, a file descriptor opened by a privileged process and passed to\nan unprivileged one now allows the entire config space to be read through\nprocfs, matching sysfs."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8a3a54aa3e65ed76f8560a387243a7738ae0cb1c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5c7ab4ca66f0880cffc3735555ea719dd5253726","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"53407535d49ec034e476121020b5c878f0d92e18","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e7730acd6a01c5931a3afb83639810ff2fb9cc92","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"77272b7fd0e472086fd626a1fcd11da625822cc2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c2d4174f492458ecdcdef309243624999612d526","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6351e94076329dab517ea94c115e15c4d8459381","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f82f53e75eff382fc8f56b73279b54f7cf5a5c65","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/53407535d49ec034e476121020b5c878f0d92e18","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c7ab4ca66f0880cffc3735555ea719dd5253726","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6351e94076329dab517ea94c115e15c4d8459381","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/77272b7fd0e472086fd626a1fcd11da625822cc2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a3a54aa3e65ed76f8560a387243a7738ae0cb1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2d4174f492458ecdcdef309243624999612d526","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7730acd6a01c5931a3afb83639810ff2fb9cc92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f82f53e75eff382fc8f56b73279b54f7cf5a5c65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93207","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:15.357","lastModified":"2026-10-19T10:17:11.487","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry\n\nsvcauth_gss_decode_credbody() writes the caller's\nrpc_gss_wire_cred field by field and assigns gc_ctx.len only on\nthe success tail.  The caller storage is svcdata->clcred, which\nlives in the per-svc_rqst gss_svc_data and is reused across\nrequests.  Early decode failures leave partially decoded state\nmixed with residue from the prior request.\n\nThe trailing body_len tightness check is the sharpest case:\nxdr_stream_decode_opaque_inline() has already written gc_ctx.data\nwith a borrowed inline pointer into the current request's XDR\npages, but gc_ctx.len retains its prior value.  Once the request\npages are released the pooled clcred carries a dangling pointer\npaired with a stale length.\n\nZero the caller's rpc_gss_wire_cred at function entry so that\nevery early-return path leaves a deterministic all-zero cred.\nOn the trailing tightness-check path, gc_ctx.len is now zero\ninstead of stale, which neuters length-driven consumers such as\ngss_svc_searchbyctx() that would otherwise walk the dangling\ndata pointer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sunrpc/auth_gss/svcauth_gss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"56b29d62017c7dd1718d060dd5b3a2ce61095d0c","versionType":"git","status":"affected"},{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"0e18641708eaa8bc3c1ff338cd844aeadbd52bac","versionType":"git","status":"affected"},{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"e0778464049b0238f2915a40007a4154f86cf351","versionType":"git","status":"affected"},{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"0fa8a8acae57e6373962741d5b06d13f44aba6a9","versionType":"git","status":"affected"},{"version":"b0bc53470d1af01f62a0fe2d405cf56477804863","lessThan":"11539e8fcce0b0af062ae5fecf7b3676c2f7aeed","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sunrpc/auth_gss/svcauth_gss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e18641708eaa8bc3c1ff338cd844aeadbd52bac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0fa8a8acae57e6373962741d5b06d13f44aba6a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/11539e8fcce0b0af062ae5fecf7b3676c2f7aeed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/56b29d62017c7dd1718d060dd5b3a2ce61095d0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0778464049b0238f2915a40007a4154f86cf351","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93208","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:15.497","lastModified":"2026-10-19T10:17:11.620","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nkasan: fix cache shrink race with CPU hotplug\n\nkasan_quarantine_remove_cache() first invokes per_cpu_remove_cache() on\nall online CPUs.  Each callback moves objects belonging to the cache from\ncpu_quarantine to the CPU's shrink_qlist, where they can later be freed\nfrom task context.\n\nkmem_cache_destroy() invokes the quarantine removal path while holding\ncpus_read_lock(), but kmem_cache_shrink() does not.  The latter can\ntherefore race with CPU offlining as follows:\n\n  kmem_cache_shrink()             CPU hotplug\n  -------------------             -----------\n  on_each_cpu()\n    CPU1 moves objects to\n    CPU1's shrink_qlist\n  on_each_cpu() returns\n                                  CPU1 goes offline\n                                  kasan_cpu_offline()\n                                    drains cpu_quarantine\n                                    leaves shrink_qlist untouched\n  for_each_online_cpu()\n    skips CPU1\n\nThe objects left on CPU1's shrink_qlist are not returned to the slab\nallocator.  This may prevent kmem_cache_shrink() from releasing slabs that\nwould otherwise become empty.  If CPU1 remains offline, a later\nkmem_cache_destroy() also skips the list and can report that the cache\nstill contains objects.\n\nAn intermittent occurrence was observed with a virtio-9p filesystem.  The\nmount and umount commands both returned 0, but the kernel logged the\nfollowing during the userspace-triggered teardown:\n\n  [  2994.380134][  T111] BUG 9p-fcall-cache-1 (Tainted: G    B              ): Objects remaining on __kmem_cache_shutdown()\n  [  2994.381140][  T111] Object 0xff11000004361118 @offset=4376\n  [  2994.381607][  T111] Allocated in p9_fcall_init+0x201/0x400 age=19564 cpu=1 pid=104\n  [  2994.382591][  T111]  p9_fcall_init+0x201/0x400\n  [  2994.382810][  T111]  p9_tag_alloc+0x12f/0x700\n  [  2994.382982][  T111]  p9_client_prepare_req+0x102/0x3e0\n  [  2994.383165][  T111]  p9_client_rpc+0x1ab/0xa50\n  [  2994.383334][  T111]  p9_client_getattr_dotl+0xb0/0x1a0\n  [  2994.383515][  T111]  v9fs_vfs_getattr_dotl+0x115/0x360\n  [  2994.383719][  T111]  vfs_getattr_nosec+0x22c/0x3a0\n  [  2994.383910][  T111]  vfs_statx+0xd7/0x170\n  [  2994.384062][  T111]  vfs_fstatat+0x45/0x80\n  [  2994.384215][  T111]  __do_sys_newfstatat+0x84/0xe0\n  [  2994.384386][  T111]  do_syscall_64+0x115/0x6a0\n  [  2994.384566][  T111]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  [  2994.399720][  T111] WARNING: mm/slub.c:1244 at __kmem_cache_shutdown+0x363/0x500, CPU#0: busybox/111\n  [  2994.405655][  T111] Call Trace:\n  [  2994.406325][  T111]  kmem_cache_destroy+0x73/0x1b0\n  [  2994.406630][  T111]  p9_client_destroy+0x271/0x3c0\n  [  2994.407210][  T111]  v9fs_session_close+0x3c/0x260\n  [  2994.407409][  T111]  v9fs_kill_super+0x48/0x90\n  [  2994.407584][  T111]  deactivate_locked_super+0xa3/0x160\n  [  2994.407778][  T111]  cleanup_mnt+0x1dd/0x3e0\n\nThus, a successful umount left objects in the 9p fcall cache and prevented\nthe cache from being destroyed cleanly.\n\nPer-CPU shrink_qlist storage exists for every possible CPU, and each list\nis protected by its own raw spinlock.  Iterate over possible CPUs so that\na list populated before its CPU went offline is drained as well.\n\nfor_each_possible_cpu() can do more work than for_each_online_cpu(), but\nthis change only affects CONFIG_KASAN_GENERIC kernels.  The extra work is\nlimited to cache shrink and cache destruction paths and does not affect\nthe normal allocation/free fast path.  It adds one raw-spinlock-protected\nscan of each possible CPU's shrink list.  These lists are normally empty;\na non-empty list is traversed to remove objects belonging to the cache\nbeing shrunk or destroyed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/kasan/quarantine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a","versionType":"git","status":"affected"},{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"709c3646545e0a1f99a5816384c633f6552c5a98","versionType":"git","status":"affected"},{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3","versionType":"git","status":"affected"},{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"3119d58e4ef8719d669911d38a53fc00086ac48b","versionType":"git","status":"affected"},{"version":"07d067e4f2ceb72b9f681995cc53828caaba9e6e","lessThan":"8790303cbaac52a11dfed4aab261f8ea60682525","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/kasan/quarantine.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30e8cb8598aa41b1b9f8803081d2ae5e5369c0f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3119d58e4ef8719d669911d38a53fc00086ac48b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/709c3646545e0a1f99a5816384c633f6552c5a98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cd164f0e1bab0f8dd125c92ed4f19bbd6b92a4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8790303cbaac52a11dfed4aab261f8ea60682525","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93209","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:15.710","lastModified":"2026-10-19T10:17:11.797","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb\n\nBT enable fails intermittently with -ETIMEDOUT (-110).  The kernel log\nshows the HCI Read Local Version command was sent and the firmware\nreplied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG),\nbut the waiter in __hci_cmd_sync_sk() never woke up and timed out\nafter 10 s:\n\n  bluetooth hci0: Opcode 0xfc00              // __hci_cmd_sync_sk\n  bluetooth hci0: opcode 0xfc00 plen 1       // hci_cmd_sync_add\n  bluetooth hci0: skb len 4                  // hci_cmd_sync_alloc\n  bluetooth hci0: length 1                   // hci_req_sync_run\n  Bluetooth: hci0 cmd_cnt 1 cmd queued 1     // hci_cmd_work\n  Bluetooth: hci0 type 1 len 4               // hci_send_frame\n  Bluetooth: opcode 0xfc00 status 0x00       // hci_req_cmd_complete\n  <-- req_skb NULL: req_complete_skb not set,\n      hci_cmd_sync_complete() never called,\n      req_status stays HCI_REQ_PEND            -->\n  <-- 10 s later: wait_event_interruptible_timeout expires -->\n  bluetooth hci0: end: err -110              // __hci_cmd_sync_sk\n\nThe root cause is that hci_send_cmd_sync() clones the sent command\ninto hdev->req_skb so that hci_req_cmd_complete() can locate the\nregistered completion callback.  Under memory pressure this\nskb_clone() fails, leaving hdev->req_skb NULL.  The firmware reply\nis received and processed, but hci_req_cmd_complete() finds NULL\nreq_skb, so hci_cmd_sync_complete() is never called, req_status\nstays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT.\n\nreq_skb is only used to read bt_cb(skb)->hci callbacks and opcode --\nit is never modified.  Replace skb_clone() with skb_get(), which\nsimply increments the reference count of hdev->sent_cmd without\nallocating new memory and therefore cannot fail.\n\nThis issue was first observed as a use-after-free in ttyport_close()\nwhen ttyport_open() failed, which was investigated in an earlier\npatch series [1].  That investigation led to the discovery of the\ntrue root cause described above.\n\n[1] https://lore.kernel.org/all/20250430111617.1151390-1-quic_cxin@quicinc.com/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/hci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"da77c1d39bc527b31890bfa0405763c82828defb","lessThan":"0337fb092873a4146aa854acb554675b49c8f6b5","versionType":"git","status":"affected"},{"version":"2af7aa6685e22d0dc546b0d27e5f16d3afe211fa","lessThan":"d5eef0747071934a1c080ee617fa4fd3566394c5","versionType":"git","status":"affected"},{"version":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a","lessThan":"d7723320db4c9cb9ec2b9a36140e6c641dd77814","versionType":"git","status":"affected"},{"version":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a","lessThan":"d0b28e9655f4b3195210627577f81883dc1d0162","versionType":"git","status":"affected"},{"version":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a","lessThan":"26f66d5b8a5663af498f7ccc94fc79fb47a2191f","versionType":"git","status":"affected"},{"version":"2615fd9a7c2507eb3be3fbe49dcec88a2f56454a","lessThan":"f5afdff569a09d1cb8cf19826199d024725576cb","versionType":"git","status":"affected"},{"version":"4ff121be63b761950610f422437aaaef8e075c40","versionType":"git","status":"affected"},{"version":"18a4c59af609994552c8b39c5438304e070e55c7","versionType":"git","status":"affected"},{"version":"6.1.83","lessThan":"6.1.118","versionType":"semver","status":"affected"},{"version":"6.6.23","lessThan":"6.6.157","versionType":"semver","status":"affected"},{"version":"6.7.11","lessThan":"6.8","versionType":"semver","status":"affected"},{"version":"6.8.2","lessThan":"6.9","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/hci_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.1.118","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0337fb092873a4146aa854acb554675b49c8f6b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26f66d5b8a5663af498f7ccc94fc79fb47a2191f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0b28e9655f4b3195210627577f81883dc1d0162","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5eef0747071934a1c080ee617fa4fd3566394c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7723320db4c9cb9ec2b9a36140e6c641dd77814","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5afdff569a09d1cb8cf19826199d024725576cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93210","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:15.877","lastModified":"2026-10-19T10:17:11.923","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: harden DFS cache against invalid target hints\n\nCurrently, get_tgt_name() returns ERR_PTR(-ENOENT) when ce->tgthint is\nNULL, and dfs_cache_noreq_update_tgthint() assumes ce->tgthint is always\nvalid.\n\nIn preparation for clearing ce->tgthint in free_tgts(), harden callers\nof get_tgt_name() against ERR_PTR results and harden\ndfs_cache_noreq_update_tgthint() against NULL pointer dereferences."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/dfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"a48328afbc3f63e3b9de8827e2e16c15b17976f7","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"6cb7f9fed8f40f28fbd464ca99c946951afc0952","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"66dbcdbb0cadffd12eb8f2b115fd57d384c5109d","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"846f0709559b9e27024e126a80bc7afb76516912","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"7e32da6047d9afdae8dd17b87b4c8d97363c4ee2","versionType":"git","status":"affected"},{"version":"54be1f6c1c37498bba557049df646cc239fa37e3","lessThan":"bf86c08123c6ab8c61cc0be1dad7540db93738ff","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/dfs_cache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/66dbcdbb0cadffd12eb8f2b115fd57d384c5109d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cb7f9fed8f40f28fbd464ca99c946951afc0952","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e32da6047d9afdae8dd17b87b4c8d97363c4ee2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/846f0709559b9e27024e126a80bc7afb76516912","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a48328afbc3f63e3b9de8827e2e16c15b17976f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf86c08123c6ab8c61cc0be1dad7540db93738ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93211","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.007","lastModified":"2026-10-19T10:17:12.023","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: initialize DRC hash table before registering shrinker\n\nshrinker_register() precedes the INIT_LIST_HEAD loop and the\ndrc_hashsize store. On weakly-ordered architectures (arm64, ppc),\na shrinker scan can observe drc_hashsize before the bucket list\nheads are initialized, causing a NULL deref in the DRC shrinker\ncallback.\n\nMove bucket initialization and the drc_hashsize store before\nshrinker_register() so the hash table is fully initialized before\nit becomes visible to the shrinker."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/nfscache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8eea99a81c6f67c08fedd7db2ccd09aa93db69a7","lessThan":"f060f43a67635dbb393bf5dcbfc3e8b9a44942cb","versionType":"git","status":"affected"},{"version":"8eea99a81c6f67c08fedd7db2ccd09aa93db69a7","lessThan":"b57bd8cb739cb3cf88bdb1a5903a42a707a5c282","versionType":"git","status":"affected"},{"version":"8eea99a81c6f67c08fedd7db2ccd09aa93db69a7","lessThan":"431c70ca5163c98c746f22f16cd58ca5aefec6dc","versionType":"git","status":"affected"},{"version":"8eea99a81c6f67c08fedd7db2ccd09aa93db69a7","lessThan":"b0c58934f5cc4f05b63ef6605dd10c1d0d489e88","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/nfscache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/431c70ca5163c98c746f22f16cd58ca5aefec6dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b0c58934f5cc4f05b63ef6605dd10c1d0d489e88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b57bd8cb739cb3cf88bdb1a5903a42a707a5c282","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f060f43a67635dbb393bf5dcbfc3e8b9a44942cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93212","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.133","lastModified":"2026-10-19T10:17:12.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: guard nfsd_serv deref in nfsd_file_net_dispose\n\nnfsd_file_net_dispose() is the consumer side of l->freeme: the nfsd\nservice thread loop calls it to drain entries that the filecache\ngarbage collector and shrinker append via\nnfsd_file_dispose_list_delayed().  During per-net teardown,\nnn->nfsd_serv is cleared before the filecache laundrette is shut\ndown, so the service thread can still run a dispose pass that finds\nmore than eight entries on l->freeme and dereferences a NULL\nsvc_serv:\n\n    nfsd service thread loop\n      nfsd_file_net_dispose(nn)\n        if (!list_empty(&l->freeme)) {\n            ...\n            svc_wake_up(nn->nfsd_serv);   /* nn->nfsd_serv == NULL */\n        }\n\nThe sibling helper nfsd_file_dispose_list_delayed() already documents\nthis ordering and caches nn->nfsd_serv into a local before testing it\nfor NULL.  nfsd_file_net_dispose() was introduced with the same raw\nsvc_wake_up(nn->nfsd_serv) call and never picked up the guard.\n\nFix by loading nn->nfsd_serv into a local svc_serv pointer and only\ncalling svc_wake_up() when it is non-NULL, matching the pattern in\nnfsd_file_dispose_list_delayed()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/filecache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ffb402596147ac583f3464ff5c48feb9423e3838","lessThan":"f4776c1c4b38fbc459420321c8ece87d0f7f95fb","versionType":"git","status":"affected"},{"version":"ffb402596147ac583f3464ff5c48feb9423e3838","lessThan":"59baf45a06435194005fc5fa9a42d89f77a30432","versionType":"git","status":"affected"},{"version":"ffb402596147ac583f3464ff5c48feb9423e3838","lessThan":"766170b4fd2daaf5c4d6735560101474e18edab6","versionType":"git","status":"affected"},{"version":"ffb402596147ac583f3464ff5c48feb9423e3838","lessThan":"9f1ddfc8cb9076592401a611eb3a44d36186d014","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/filecache.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/59baf45a06435194005fc5fa9a42d89f77a30432","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/766170b4fd2daaf5c4d6735560101474e18edab6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f1ddfc8cb9076592401a611eb3a44d36186d014","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4776c1c4b38fbc459420321c8ece87d0f7f95fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93213","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.257","lastModified":"2026-10-19T10:17:12.210","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nof: fix out-of-bounds read in of_alias_scan() stem parser\n\nThe stem parser tests isdigit(*(end - 1)) before checking end > start\nand so reads one byte before the property name when the name is empty\nor all digits. Check the bound first."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/of/base.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"fd0c7bbda81c0e0c1cb7b68d267b87371584f560","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"958d7ee9fcf008ef9d2072c6410ee1bf6abf3b64","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"f7f6c3e32a31f2e1ed12075e8cd22b370a84e67a","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"da7a80ddc610a19b0378016a4d816b9355f013a7","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"96a9c984dd7c3589a2707a32b62802f98311dbfd","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"9253cfc5a85be1494ce56b4fc6f2d2b509440910","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"acd1b49043366f43e932308b4db7d3ce568eeadb","versionType":"git","status":"affected"},{"version":"611cad720148c899db5a383c1c676fd820df7023","lessThan":"5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/of/base.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9253cfc5a85be1494ce56b4fc6f2d2b509440910","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/958d7ee9fcf008ef9d2072c6410ee1bf6abf3b64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96a9c984dd7c3589a2707a32b62802f98311dbfd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/acd1b49043366f43e932308b4db7d3ce568eeadb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da7a80ddc610a19b0378016a4d816b9355f013a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7f6c3e32a31f2e1ed12075e8cd22b370a84e67a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd0c7bbda81c0e0c1cb7b68d267b87371584f560","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93214","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.397","lastModified":"2026-10-19T10:17:12.323","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: f_tcm: fix deadlock in usbg_make_tpg()\n\nusbg_make_tpg() held dep_lock while calling\nconfigfs_depend_item_unlocked(), which acquires the configfs root\ninode lock when operating across subsystems. This creates a circular\nlock dependency with configfs_rmdir():\n\n  dep_lock -> configfs root inode lock -> su_mutex -> dep_lock\n\nIn usbg_make_tpg(), dep_lock only serialized the read of opts->ready,\nwhich is a monotonic flag that transitions from false to true exactly\nonce (in tcm_set_name()) and never reverts. Remove dep_lock from\nusbg_make_tpg() entirely and use READ_ONCE/WRITE_ONCE to access\nopts->ready locklessly instead."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/function/f_tcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"abad5daa41cf5d0a0a9cba0397d3a0e7f11e0277","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"3639438a4c83ffc2e564c8c010b92137c5d11cfa","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"78a14ea2284825055ab6c2a1f3489510f560f3a2","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"eef3e62f90d86c1c5651742f84ecc9db1814a893","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"f81a2da137b029a282b9bc64d2f267d242948659","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"6bcd9ee6ad6989d1d85a7459687e45b7ad7568d9","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"d90b0f90e30cd59b36005a4016b15cf02bcd7fb2","versionType":"git","status":"affected"},{"version":"4bb8548df632187d5db50878e71804af5f7c51ad","lessThan":"9dbf74f4022f80f7669d2b3c22c5deb46c1b5674","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/function/f_tcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.5","status":"affected"},{"version":"0","lessThan":"4.5","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3639438a4c83ffc2e564c8c010b92137c5d11cfa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bcd9ee6ad6989d1d85a7459687e45b7ad7568d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78a14ea2284825055ab6c2a1f3489510f560f3a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9dbf74f4022f80f7669d2b3c22c5deb46c1b5674","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abad5daa41cf5d0a0a9cba0397d3a0e7f11e0277","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d90b0f90e30cd59b36005a4016b15cf02bcd7fb2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eef3e62f90d86c1c5651742f84ecc9db1814a893","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f81a2da137b029a282b9bc64d2f267d242948659","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93215","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.550","lastModified":"2026-10-19T10:17:12.440","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncdx: Fix double free when sysfs file creation fails\n\nIn cdx_create_res_attr(), if sysfs_create_bin_file() fails, the code\nfrees res_attr but doesn't set cdx_dev->res_attr[num] to NULL. This\nleaves a dangling pointer in the array. Then cdx_destroy_res_attr()\nfrees the already-freed memory. Fix the double free by initializing\ncdx_dev->res_attr[num] after sysfs_create_bin_file() completes."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/cdx/cdx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aeda33ab8160c7a2e24ba4f44492ad1e974ddc7d","lessThan":"88f4cd42a04bdadd189d7f667a4c279f4e962ca6","versionType":"git","status":"affected"},{"version":"aeda33ab8160c7a2e24ba4f44492ad1e974ddc7d","lessThan":"4cd24873ab9fdbd730604881a6e8087bc7b99336","versionType":"git","status":"affected"},{"version":"aeda33ab8160c7a2e24ba4f44492ad1e974ddc7d","lessThan":"7e9451bf0bdba6daee1eaf4e7566612af6ca1c32","versionType":"git","status":"affected"},{"version":"aeda33ab8160c7a2e24ba4f44492ad1e974ddc7d","lessThan":"6f4acc3a3c300e174e3f586b97b04ed8f5948c36","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/cdx/cdx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4cd24873ab9fdbd730604881a6e8087bc7b99336","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f4acc3a3c300e174e3f586b97b04ed8f5948c36","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e9451bf0bdba6daee1eaf4e7566612af6ca1c32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88f4cd42a04bdadd189d7f667a4c279f4e962ca6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93216","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.670","lastModified":"2026-10-21T13:21:04.503","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()\n\nprint_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the\nstart to guard against tail pages and NULL data.  However, it later\nre-reads page->memcg_data locklessly in two places:\n\n1: page_memcg_check(page)\n\n2: PageMemcgKmem(page) (via folio_memcg_kmem(), which includes\n   VM_BUG_ON assertions for tail pages and MEMCG_DATA_OBJEXTS)\n\nIf the page is concurrently freed and reallocated as a THP tail page or\nslab page between these calls, the VM_BUG_ON assertions can trigger on\nCONFIG_DEBUG_VM=y builds, crashing the kernel.\n\nFix both TOCTOU issues by using the memcg_data snapshot throughout."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/page_owner.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"e7c1923c5f30a6953f0540e3171d882ec17b05d3","versionType":"git","status":"affected"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"a4c940ab3f794f221a338c9431ad1ce0d73a2bea","versionType":"git","status":"affected"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"46761406e14381dc35f498c247a87565b87ea2ef","versionType":"git","status":"affected"},{"version":"fcf8935832b86d3437f00e732c6d0d4d2819d6a9","lessThan":"90f095b816e25c6a9e4446d299bac5007fdcb3df","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/page_owner.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/46761406e14381dc35f498c247a87565b87ea2ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90f095b816e25c6a9e4446d299bac5007fdcb3df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4c940ab3f794f221a338c9431ad1ce0d73a2bea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7c1923c5f30a6953f0540e3171d882ec17b05d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93217","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.790","lastModified":"2026-10-19T10:17:12.627","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/madvise: skip device-private PMDs in cold and pageout walks\n\nmadvise_cold_or_pageout_pte_range() takes pmd_trans_huge_lock(), whose\npmd_is_huge() check returns true for a device-private PMD.  The subsequent\n!pmd_present() branch has a VM_BUG_ON() asserting migration is the only\nallowed non-present case; a device-private PMD trips it.\n\nSkip device-private PMDs in that non-present branch and continue to\nhuge_unlock before calling pmd_folio().  Downgrade the check to\nVM_WARN_ON_ONCE() so an unexpected PMD softleaf logs a warning rather than\npanicking.  Drop the thp_migration_supported() guard: it expands to\nIS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both\npmd_is_migration_entry() and pmd_is_device_private_entry() already return\nfalse when that config is not selected, so the guard suppresses only the\ncase where the warning would already be silent.\n\nPotential trigger: an HMM-based GPU driver races with\nmadvise(MADV_COLD)/MADV_PAGEOUT: pmd_trans_huge(*pmd) reads true, then\nmigrate_vma_pages() flips the PMD to a device-private entry before the PMD\nlock is acquired."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/madvise.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"368076f52ebeecd33e10a9f80905d7508b6b6149","lessThan":"5c0d7b658cda62cd17cb3652783386d5608030ef","versionType":"git","status":"affected"},{"version":"368076f52ebeecd33e10a9f80905d7508b6b6149","lessThan":"d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/madvise.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5c0d7b658cda62cd17cb3652783386d5608030ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4b76d0b03cb49611312ecc4bcfb55ccdf0843e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93218","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:16.907","lastModified":"2026-10-19T10:17:12.730","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd\n\nmadvise_free_pte_range() checks pmd_trans_huge(*pmd) unlocked, then\nmadvise_free_huge_pmd() takes pmd_trans_huge_lock().  pmd_is_huge()\nreturns true for a device-private PMD, so orig_pmd can be device-private\nand enter the !pmd_present() branch.\n\nSkip device-private PMDs in that non-present branch and continue to out\nbefore calling pmd_folio().  Downgrade the check to VM_WARN_ON_ONCE() so\nan unexpected PMD softleaf logs a warning rather than panicking.  Drop the\nthp_migration_supported() guard: it expands to\nIS_ENABLED(CONFIG_ARCH_SUPPORTS_PMD_SOFTLEAF), and both\npmd_is_migration_entry() and pmd_is_device_private_entry() already return\nfalse when that config is not selected, so the guard suppresses only the\ncase where the warning would already be silent.\n\nPotential trigger: an HMM-based GPU driver races with madvise(MADV_FREE):\nmigrate_vma_pages() flips the PMD to a device-private entry between the\ncaller's pmd_trans_huge() check and the callee's pmd_trans_huge_lock()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/huge_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"368076f52ebeecd33e10a9f80905d7508b6b6149","lessThan":"5e3026bf736498115884d6c7bd0308ba29e0474c","versionType":"git","status":"affected"},{"version":"368076f52ebeecd33e10a9f80905d7508b6b6149","lessThan":"ce579dcf730ce5ed8043a5eeea18a3e6706a97e5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/huge_memory.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5e3026bf736498115884d6c7bd0308ba29e0474c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce579dcf730ce5ed8043a5eeea18a3e6706a97e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93219","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.030","lastModified":"2026-10-19T10:17:12.820","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/timer-sun4i: Advertise a real minimum delta\n\nsun4i_clkevt_next_event() compensates for the timer stop/start\nsynchronization delay by programming evt - TIMER_SYNC_TICKS into the\nhardware interval register. The clockevent device currently advertises\nTIMER_SYNC_TICKS as min_delta_ticks, so the clockevents core is allowed\nto call set_next_event() with evt == TIMER_SYNC_TICKS.\n\nThat programs a zero-tick interval. With oneshot/highres/nohz timer\noperation this can leave the next event stuck, which was observed as a\nboot hang on Allwinner D1 after the clockevents core started reusing\nforced minimum-delta events.\n\nAdvertise one extra tick instead, so the smallest event accepted by the\ncore still programs at least one hardware tick after the synchronization\ncompensation."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/clocksource/timer-sun4i.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"0cc4b14d7401d50e53a01f1554147ee075ee6943","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"53a3bc024b8e5d284468cce84957cded5f859f98","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"753a220084dfc4d737f2ab9eaddc9a01a397edd7","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"ebba4d0aeba0e8eb3a9676380fc2652de8ab1c44","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"151eb52f8712017c8f7b00bb2305e8916cb9e3dc","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"bf38be01d43c4e4ca903aff7236d8486a950a252","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"f0efafcdf6eec1f3361bfd8c811420198f55c8bb","versionType":"git","status":"affected"},{"version":"12e1480bcb4920c1b02b3793cb48756497919a60","lessThan":"d21808328225ab8cee46885bf9a0dffcefbe630e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/clocksource/timer-sun4i.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0cc4b14d7401d50e53a01f1554147ee075ee6943","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/151eb52f8712017c8f7b00bb2305e8916cb9e3dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/53a3bc024b8e5d284468cce84957cded5f859f98","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/753a220084dfc4d737f2ab9eaddc9a01a397edd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf38be01d43c4e4ca903aff7236d8486a950a252","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d21808328225ab8cee46885bf9a0dffcefbe630e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebba4d0aeba0e8eb3a9676380fc2652de8ab1c44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0efafcdf6eec1f3361bfd8c811420198f55c8bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93220","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.197","lastModified":"2026-10-19T10:17:12.933","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched_ext: Keep kick_sync waiting on the rq's own CPU\n\nkick_sync_wait_bal_cb() assumes it runs on the rq's CPU from the\n__schedule() tail: the snapshots it compares against live in that CPU's\npercpu area and the busy-wait runs with the rq lock dropped and IRQs\nenabled.\n\nHowever, dispatch can now drop the rq lock while the callback sits queued,\nand rq lock takers in that window (the sched class change paths, the scx\ntask iterator) flush pending balance callbacks on release, running the\ncallback on a foreign CPU. Such a run compares against unrelated snapshots\nand can deadlock when the executing CPU is itself a wait target.\n\nBail on a foreign CPU and leave the wait state alone. The wait only observes\nprogress that the resched kicks already guarantee and the rq's next wait\npicks up the stale cpus_to_sync bits."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/ext/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4c95380701f58b8112f0b891de8d160e4199e19d","lessThan":"c736ea0fe7b4df920da6bd43a81c5eeecadcc8be","versionType":"git","status":"affected"},{"version":"4c95380701f58b8112f0b891de8d160e4199e19d","lessThan":"e0253dd04beb03e79477c5ef4768b11135687206","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/ext/ext.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/c736ea0fe7b4df920da6bd43a81c5eeecadcc8be","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0253dd04beb03e79477c5ef4768b11135687206","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93221","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.310","lastModified":"2026-10-21T13:21:04.787","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: convert nfsd_net boolean flags to unsigned long flags word\n\nnfsd_net contains several boolean fields that are accessed from\nconcurrent contexts without serialization.  In particular,\nnfsd4_end_grace() guards its drain path with a plain bool:\n\n    if (nn->grace_ended)\n            return;\n    nn->grace_ended = true;\n\nThe read and the write are independent, and nothing in struct\nnfsd_net serializes them.  At least two contexts can reach this\ncode with no lock held:\n\n    laundromat path\n      laundry_wq kworker\n        nfs4_laundromat()\n          nfsd4_end_grace()\n\n    RECLAIM_COMPLETE path\n      nfsd compound kthread\n        nfsd4_reclaim_complete()\n          inc_reclaim_complete()\n            nfsd4_end_grace()\n\nBoth callers can observe grace_ended == false on different CPUs,\nboth store true, and both proceed into nfsd4_record_grace_done(),\nwhich invokes the active client_tracking_ops->grace_done callback.\nFor tracking ops that drain reclaim_str_hashtbl (legacy_tracking_ops\nvia nfsd4_recdir_purge_old, and the cld v1+ ops via\nnfsd4_cld_grace_done), grace_done calls nfs4_release_reclaim(),\nwhich walks every bucket of reclaim_str_hashtbl with no lock and\ncalls nfs4_remove_reclaim_record() (list_del + kfree) on each\nentry.  Two concurrent walkers corrupt the list and double-free\nevery nfs4_client_reclaim.  A concurrent nfsd4_find_reclaim_client()\niterating the same bucket reads through freed memory.\n\nA third call site exists in nfs4_state_start_net() on the\nskip_grace startup path, but it runs under nfsd_mutex before any\nclient has connected and before the laundromat's first delayed\nwork fires, so it cannot race with the two callers above.\n\nReplace the scattered boolean fields in nfsd_net with a single\nunsigned long flags word and an enum nfsd_net_flag for the bit\npositions.  The grace_ended race is fixed by using\ntest_and_set_bit(), which is atomic on all architectures.  The\nremaining flags (grace_end_forced, in_grace, somebody_reclaimed,\ntrack_reclaim_completes, nfsd_net_up, lockd_up) are converted to\nuse test_bit/set_bit/clear_bit for consistency.  This avoids\nsub-word cmpxchg issues on architectures like Hexagon that only\nsupport word-sized atomic operations."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/netns.h","fs/nfsd/nfs4proc.c","fs/nfsd/nfs4recover.c","fs/nfsd/nfs4state.c","fs/nfsd/nfsctl.c","fs/nfsd/nfssvc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"94b450977c60261903c945419d2df4a464de60c4","versionType":"git","status":"affected"},{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"faac245ca739b66e96fb7bb43e21df537239a4e5","versionType":"git","status":"affected"},{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"40bab0da844c142431a6b1cc21b4cf53491dac44","versionType":"git","status":"affected"},{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"df5922fe09a8131c793ffa86adf204999b0470f8","versionType":"git","status":"affected"},{"version":"362063a595be959bc08f4163e6405a0266740091","lessThan":"11a5fe42e1811f793e04ef885b639ea7668f439d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/netns.h","fs/nfsd/nfs4proc.c","fs/nfsd/nfs4recover.c","fs/nfsd/nfs4state.c","fs/nfsd/nfsctl.c","fs/nfsd/nfssvc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/11a5fe42e1811f793e04ef885b639ea7668f439d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/40bab0da844c142431a6b1cc21b4cf53491dac44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94b450977c60261903c945419d2df4a464de60c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df5922fe09a8131c793ffa86adf204999b0470f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/faac245ca739b66e96fb7bb43e21df537239a4e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93222","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.437","lastModified":"2026-10-19T10:17:13.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsignal: avoid shared siginfo namespace rewrites\n\nsend_signal_locked() rewrites sender ids for the target namespace.  Group\nsends reuse the same siginfo, so one recipient can affect the next.\n\nCopy the siginfo before changing it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/signal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"e015d1ac6b43a23c52c5163299414ae77d7d4ae0","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"4ee7c4e4719a825052f42f02ec159b5b42b68fbc","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"148b0dae2a1755beb873a2aab51fb191414f068c","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"6b1de022304ef85284c5933a5fb8492f6f54efc9","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"03c8761e75d1619906bb503686f9cc1dfc6a67f4","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"a246da20c8e4ae4319511c698b9f26ad0ad1769f","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"b655c2040ce836afad5643842543567b31f8c11d","versionType":"git","status":"affected"},{"version":"7a0cf094944e2540758b7f957eb6846d5126f535","lessThan":"d19cdc167e696714509e87d3f7ae765b6e164589","versionType":"git","status":"affected"},{"version":"e897dd22800f02bd48aefb1511fff0b2ce96e94c","versionType":"git","status":"affected"},{"version":"2f0e9eed11ca778d0ec5507a739c28472fd4ca20","versionType":"git","status":"affected"},{"version":"5.1.20","lessThan":"5.2","versionType":"semver","status":"affected"},{"version":"5.2.3","lessThan":"5.3","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/signal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03c8761e75d1619906bb503686f9cc1dfc6a67f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/148b0dae2a1755beb873a2aab51fb191414f068c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ee7c4e4719a825052f42f02ec159b5b42b68fbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b1de022304ef85284c5933a5fb8492f6f54efc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a246da20c8e4ae4319511c698b9f26ad0ad1769f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b655c2040ce836afad5643842543567b31f8c11d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d19cdc167e696714509e87d3f7ae765b6e164589","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e015d1ac6b43a23c52c5163299414ae77d7d4ae0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93223","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.590","lastModified":"2026-10-19T10:17:13.260","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: media: tegra-video: fix of_node_put() on VIP parse errors\n\ntegra_vip_channel_of_parse() initializes np from dev->of_node without\ntaking a reference, but its error paths drop one through the\nerr_node_put label. This underflows the refcount of the VIP device's\nOF node when endpoint parsing fails on a malformed device tree.\n\nThe only reference the function takes on np is the success-path\nof_node_get() stored in vip->chan.of_node, and that one is already\nreleased by the tegra_vip_init() error path and by tegra_vip_exit().\n\nReturn errors directly instead of jumping to the bogus cleanup label."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/media/tegra-video/vip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"a3783800c9475fa58b8db0885893f96a23f949da","versionType":"git","status":"affected"},{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"1295ba29ac590bbb5c4a586afd408018168af10b","versionType":"git","status":"affected"},{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"656d047dc0c29c0964d840217a0593f16aa9bc5e","versionType":"git","status":"affected"},{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"fc9937019cf7e2fe4e29f9341e6400bcd2cde721","versionType":"git","status":"affected"},{"version":"e740d199cf0ff1e53ddc2ab067c0a09b55845d68","lessThan":"7393372f79db940acff206b43e2905685a0c57ad","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/media/tegra-video/vip.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1295ba29ac590bbb5c4a586afd408018168af10b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/656d047dc0c29c0964d840217a0593f16aa9bc5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7393372f79db940acff206b43e2905685a0c57ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3783800c9475fa58b8db0885893f96a23f949da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc9937019cf7e2fe4e29f9341e6400bcd2cde721","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93224","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.720","lastModified":"2026-10-19T10:17:13.357","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Fix unmatched rn_unregister on failed accept\n\nWhen svc_rdma_accept() takes the errout path before\nrpcrdma_rn_register() has succeeded, the existing cleanup block\ncalls rpcrdma_rn_unregister(dev, &newxprt->sc_rn) unconditionally.\nsvcxprt_rdma is kzalloc'd, so on that path sc_rn.rn_index is 0 and\nsc_rn.rn_done is NULL; the unregister therefore xa_erase()s another\ncaller's slot 0 and performs an unmatched kref_put() on the\nrpcrdma_device's rd_kref.\n\nThe same errout also brackets the cleanup with svc_xprt_get()/\nsvc_xprt_put() around the kref_init() birth reference. The kref\ngoes 1 -> 2 -> 1 and never reaches 0, so the svcxprt_rdma (and the\nnet/ns_tracker it pinned) is leaked on every failed accept.\n\nrpcrdma_rn_register() writes rn->rn_done last, only after xa_alloc()\nand kref_get() have both succeeded, so rn_done == NULL is a natural\n\"never registered\" sentinel. Guard rpcrdma_rn_unregister() with an\nearly return when rn_done is NULL, and clear rn_done before the\nmatching xa_erase() so a repeated unregister is also a no-op.\n\nWith that guard in place, the accept errout drops the kref_init()\nbirth reference via svc_xprt_put(), which dispatches svc_rdma_free().\nTeardown of sc_qp, sc_sq_cq, sc_rq_cq, and sc_pd runs under existing\nIS_ERR/NULL guards in svc_rdma_free(); sc_rn is covered by the new\nrn_done sentinel; sc_cm_id is non-NULL on every errout path because\nsvc_rdma_accept() dereferences it above the first goto errout.\n\nsvc_xprt_free() drops the module reference associated with the freed\ntransport, and svc_handle_xprt() drops its pre-acquired reference\nwhen ->xpo_accept() returns NULL. Take a replacement module reference\nbefore svc_xprt_put() so the two module_put()s remain balanced.\n\nThe rn_done guard also covers svc_rdma_free()'s non-listener call\nto rpcrdma_rn_unregister() for transports whose register attempt\nfailed or never ran."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sunrpc/xprtrdma/ib_client.c","net/sunrpc/xprtrdma/svc_rdma_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb3cba0ec372fa7c5f5f5c12990bef02e458ab86","lessThan":"0335800071a6dfdf7d21d729b5e7d8fa98936211","versionType":"git","status":"affected"},{"version":"8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932","lessThan":"5aabe070c00e5bdf4ab150fb5f72ad5f266d6241","versionType":"git","status":"affected"},{"version":"8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932","lessThan":"45a444a17240f4fa2235f0dfd4a96fc80f1eb2c2","versionType":"git","status":"affected"},{"version":"8ac6fcae5dc0e801f1c82a83f5ae2c0a4db19932","lessThan":"26190394c64c9429481fc88a4738f70bb92fb352","versionType":"git","status":"affected"},{"version":"d310955106c358c8e1ea682defd8e21af44a6cba","versionType":"git","status":"affected"},{"version":"6.12.35","lessThan":"6.12.109","versionType":"semver","status":"affected"},{"version":"6.15.4","lessThan":"6.16","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sunrpc/xprtrdma/ib_client.c","net/sunrpc/xprtrdma/svc_rdma_transport.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0335800071a6dfdf7d21d729b5e7d8fa98936211","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26190394c64c9429481fc88a4738f70bb92fb352","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45a444a17240f4fa2235f0dfd4a96fc80f1eb2c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5aabe070c00e5bdf4ab150fb5f72ad5f266d6241","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93225","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.857","lastModified":"2026-10-19T10:17:13.503","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nphy: fsl-imx8mq-usb: fix typec switch leak on probe error path\n\nIf probe fails after imx95_usb_phy_get_tca() succeeds, the typec\nswitch leaks because the only cleanup path was in .remove(), which\nnever runs on probe failure.\n\nUse devm_add_action_or_reset() so the switch is cleaned up on both\nprobe failure and driver removal. The imx95_usb_phy_put_tca() is no\nlonger needed, it will be removed in .remove() too."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/phy/freescale/phy-fsl-imx8mq-usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b58f0f86fd6156d7b084257f5c91ceaf7d760927","lessThan":"f1b7b2c7ffa9711d1298f52790b377fe02efc1db","versionType":"git","status":"affected"},{"version":"b58f0f86fd6156d7b084257f5c91ceaf7d760927","lessThan":"84646f5b945a370f6999eed59a334387b0abc282","versionType":"git","status":"affected"},{"version":"b58f0f86fd6156d7b084257f5c91ceaf7d760927","lessThan":"87a1805b1c346b092c34f96f3806f207792910e1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/phy/freescale/phy-fsl-imx8mq-usb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/84646f5b945a370f6999eed59a334387b0abc282","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87a1805b1c346b092c34f96f3806f207792910e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1b7b2c7ffa9711d1298f52790b377fe02efc1db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93226","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:17.973","lastModified":"2026-10-19T10:17:13.610","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: use RCU iterator to dump route exceptions\n\nrt6_nh_dump_exceptions() uses hlist_for_each_entry() to iterate over\nRCU-protected exception lists. The caller holds rcu_read_lock(), but does\nnot hold rt6_exception_lock, so rt6_insert_exception() can concurrently\nadd an entry with hlist_add_head_rcu().\n\nKCSAN reports this race (irrelevant details omitted):\n\n  ==================================================================\n  BUG: KCSAN: data-race in rt6_insert_exception / rt6_nh_dump_exceptions\n\n  write (marked) to 0xffff8a7c44c59620 of 8 bytes by interrupt on cpu 5:\n    rt6_insert_exception+0x3bb/0x760\n    __ip6_rt_update_pmtu+0x4fe/0x750\n    ip6_sk_update_pmtu+0x19a/0x3b0\n    udpv6_err+0x3ff/0x800\n    icmpv6_notify+0x1e1/0x440\n    icmpv6_rcv+0x8c0/0xab0\n    ip6_protocol_deliver_rcu+0x616/0x840\n    ip6_input_finish+0xb9/0x160\n    ...\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  read to 0xffff8a7c44c59620 of 8 bytes by task 549 on cpu 14:\n    rt6_nh_dump_exceptions+0xb3/0x260\n    rt6_dump_route+0x53e/0x5f0\n    fib6_dump_node+0x6d/0xf0\n    fib6_walk_continue+0x290/0x2d0\n    fib6_dump_table+0x28d/0x360\n    inet6_dump_fib+0x37d/0x620\n    rtnl_dumpit+0x7b/0xd0\n    netlink_dump+0x3ae/0x7e0\n    ...\n    entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  4 locks held by dumper/549:\n    ...\n    #1: (rcu_read_lock){....}-{1:3}, at: inet6_dump_fib+0x88/0x620\n    #2: (&tb->tb6_lock){+.-.}-{3:3}, at: fib6_dump_table+0x1e9/0x360\n    #3: (rcu_read_lock){....}-{1:3}, at: rt6_dump_route+0x483/0x5f0\n\n  value changed: 0xffff8a7c44e05700 -> 0xffff8a7c45d60100\n\n  Reported by Kernel Concurrency Sanitizer on:\n  CPU: 14 UID: 0 PID: 549 Comm: dumper Not tainted\n  7.2.0-rc7-virtme #38 PREEMPT(lazy)\n  ...\n\nUse hlist_for_each_entry_rcu() to safely iterate over the exception list."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"dffbfb3117138e8e0e09d05f507bd36ca1f696e5","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"6bd3f94ed858f2d072627546b4cdf712b0f8ea88","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"9c6be625e1a7258e845d6193b3b6b084a00f8e9e","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"3665abc3d2ae8a78cb67f858e848481432ec75db","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"eda56ee17713f9dd834b922f7dbfa2e25fa6358c","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"a602cd128d17a793e12888edc8eda85821ede7e1","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"f6b1b15848fd91fe122dac0d19d3d666e35075b6","versionType":"git","status":"affected"},{"version":"1e47b4837f3bdaa425727cfe09f5ae3b6c4c41a9","lessThan":"47cdab0d51aaa9bd85f8e4904585bd5bd4df4488","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/route.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3665abc3d2ae8a78cb67f858e848481432ec75db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/47cdab0d51aaa9bd85f8e4904585bd5bd4df4488","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bd3f94ed858f2d072627546b4cdf712b0f8ea88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c6be625e1a7258e845d6193b3b6b084a00f8e9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a602cd128d17a793e12888edc8eda85821ede7e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dffbfb3117138e8e0e09d05f507bd36ca1f696e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eda56ee17713f9dd834b922f7dbfa2e25fa6358c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6b1b15848fd91fe122dac0d19d3d666e35075b6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93227","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.130","lastModified":"2026-10-19T10:17:13.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn\n\nWith CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled, deferred_grow_zone()\ninitializes struct pages early in boot to satisfy an allocation.\n\nWith a large CMA reservation in place, the ranges deferred_init_memmap()\nfinds may not add up to the allocation it was asked for, and the function\nends up initializing the memory map of the entire zone and still falls\nshort.\n\nThat is fine in itself: the function accounts for it and leaves the\ncaller to decide whether it now has enough memory.\n\nHowever, the update of pgdat->first_deferred_pfn that tracks where\nuninitialized memory map starts could overflow.\n\nIf the node's RAM end is not aligned on PAGES_PER_SECTION boundaries and\nsome deferred struct pages were initialized, pgdat->first_deferred_pfn\nwould point past the end of the node's memory.\n\ndeferred_init_memmap() later picks up from pgdat->first_deferred_pfn and\nhits a BUG_ON(), because it expects a pfn within its node.\n\nFor example, when running a kernel with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y\nand CONFIG_CMA=y using the following qemu command line\n\n  qemu-system-x86_64 -enable-kvm -m 8032M -kernel bzImage \\\n      -append \"nokaslr cma=4768M@0x100000000\"\n\nthe kernel panics:\n\n  kernel BUG at mm/mm_init.c:2131!\n  CPU: 3 UID: 0 PID: 36 Comm: pgdatinit0 Not tainted 7.2.0-rc6 #1\n  RIP: 0010:deferred_init_memmap+0x1b8/0x1c0\n  RAX: 0000000000236000 R13: 0000000000238000\n  Call Trace:\n   kthread+0xdf/0x120\n   ret_from_fork+0x187/0x250\n\nMake sure that the update of pgdta->first_deferred_pfn does not overflow\nwhen the entire zone's (and therefore node's) memory map is initialized.\n\n[rppt: massaged the changelog]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/mm_init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3acb913c9d5bd8dcf61677ccba96d349e7681cf8","lessThan":"45489d4f95802903ab35799b400b346fa4e13151","versionType":"git","status":"affected"},{"version":"3acb913c9d5bd8dcf61677ccba96d349e7681cf8","lessThan":"84339578c2d6936ac3a93cd1f0bbaa3468a988f2","versionType":"git","status":"affected"},{"version":"3acb913c9d5bd8dcf61677ccba96d349e7681cf8","lessThan":"97090500d776c3f6d08e857e3a0a7cf092999094","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/mm_init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/45489d4f95802903ab35799b400b346fa4e13151","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84339578c2d6936ac3a93cd1f0bbaa3468a988f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97090500d776c3f6d08e857e3a0a7cf092999094","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93228","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.253","lastModified":"2026-10-21T13:21:05.080","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Reject Write/Reply chunks with segcount 0\n\nA peer can send a Write or Reply chunk whose segcount field is zero.\nxdr_check_write_chunk() only rejects segcount > rc_maxpages, so zero\npasses the range check, and xdr_inline_decode(stream, 0) returns the\ncurrent (non-NULL) cursor without advancing. The function returns\ntrue and pcl_alloc_write() then links a struct svc_rdma_chunk with\nch_segcount == 0 onto rc_write_pcl or rc_reply_pcl.\n\nAn earlier patch in this series made pcl_for_each_segment() safe for\nch_segcount == 0, so this no longer drives the memory walk it used\nto. Rejecting the malformed frame at the decode boundary is still\nworthwhile as defense in depth: it keeps degenerate zero-segment\nchunks off the parsed chunk lists entirely, so any future consumer\nthat walks ch_segments directly cannot observe one, and it makes the\nzero-floor easy to backport to trees where the macro change is more\nintrusive. RFC 8166 has no meaning for a Write/Reply chunk that\ndescribes no remote buffer, so no legitimate client is affected.\n\nxdr_check_reply_chunk() funnels Reply chunks through\nxdr_check_write_chunk() and inherits the same rejection.\n\npcl_alloc_write() also links each chunk onto the parsed chunk list\nbefore filling its segment array. If a future change weakens the\nsegcount-0 rejection, an incomplete chunk is visible to consumers\nduring the fill loop. Reorder so that list_add_tail() follows the\nsegment fill loop, ensuring only fully-populated chunks appear on\nthe list."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/sunrpc/xprtrdma/svc_rdma_pcl.c","net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"28c5a3a572f6cf81ac304459cfd515480995d62a","versionType":"git","status":"affected"},{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f","versionType":"git","status":"affected"},{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"a798714b58041e88716db3bf8fb03ae13eecd54a","versionType":"git","status":"affected"},{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"45dbdb2637b7fc5f1355b588780d2a7fb0516805","versionType":"git","status":"affected"},{"version":"78147ca8b4a9b6cf0e597ddd6bf17959e08376c2","lessThan":"9808eb7656666acc7291bae9ab6b987bd16e47e0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/sunrpc/xprtrdma/svc_rdma_pcl.c","net/sunrpc/xprtrdma/svc_rdma_recvfrom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/28c5a3a572f6cf81ac304459cfd515480995d62a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45dbdb2637b7fc5f1355b588780d2a7fb0516805","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9808eb7656666acc7291bae9ab6b987bd16e47e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a798714b58041e88716db3bf8fb03ae13eecd54a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe533ae1bed2ef2b3d54ee7ab410da1874ed3d4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93229","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.387","lastModified":"2026-10-19T10:17:13.957","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: add missing read barrier to rpc_status_get dumpit seqcount retry\n\nThe hand-rolled seqcount-like protocol in nfsd_nl_rpc_status_get_dumpit()\nis missing a read memory barrier (smp_rmb) before its second counter\ncheck.  The standard kernel read_seqcount_retry() includes smp_rmb()\nto ensure that all data reads complete before the counter is re-checked.\n\nWithout this barrier, on weakly-ordered architectures (ARM, POWER),\nthe CPU may reorder field reads past the second counter check, making\nthe retry logic ineffective: it could observe a consistent counter pair\nwhile reading fields that have been concurrently modified by the writer.\n\nAdd smp_rmb() before the second counter check to order the field reads\nahead of it, matching the barrier semantics of the standard seqcount\nread-side.  The begin-side smp_load_acquire() already pairs with the\nsmp_store_release() in nfsd_dispatch(); with the smp_rmb() now ordering\nthe field reads, the retry check no longer needs acquire semantics and\nreads the counter with a plain READ_ONCE(), as read_seqcount_retry()\ndoes.\n\n[ cel: Use READ_ONCE instead of smp_load_acquire() ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bd9d6a3efa9709e653aafbeb859289feccb8e70c","lessThan":"f501f2f4ec1d2dfe39e21c98630314074a9b30b0","versionType":"git","status":"affected"},{"version":"bd9d6a3efa9709e653aafbeb859289feccb8e70c","lessThan":"1aea0482b98ecd7d0249204665f2ad4ad517f66b","versionType":"git","status":"affected"},{"version":"bd9d6a3efa9709e653aafbeb859289feccb8e70c","lessThan":"9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8","versionType":"git","status":"affected"},{"version":"bd9d6a3efa9709e653aafbeb859289feccb8e70c","lessThan":"a71f161a857117e8e0264deb7d14fff5c98adcf5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/nfsd/nfsctl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.109","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.50","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/1aea0482b98ecd7d0249204665f2ad4ad517f66b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b5f6475006cd8e3b5b99b8eb3cd74dbb1ce9df8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a71f161a857117e8e0264deb7d14fff5c98adcf5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f501f2f4ec1d2dfe39e21c98630314074a9b30b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93230","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.517","lastModified":"2026-10-21T13:21:05.430","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier\n\nGigantic bootmem HugeTLB pages are currently initialized from\nhugetlb_init(), but page_alloc_init_late() runs earlier and walks\npageblocks to determine zone contiguity.\n\nIf a bootmem HugeTLB region is marked noinit, set_zone_contiguous() can\nobserve still-uninitialized struct pages through\n__pageblock_pfn_to_page().  This may not trigger an immediate failure, but\nit can make set_zone_contiguous() compute the wrong zone contiguity state.\nIf extra poisoned-page checks are added in this path, such as\nPF_POISONED_CHECK() in page_zone_id(), it can also trigger an early boot\npanic.\n\nInitialize gigantic bootmem HugeTLB struct pages from\npage_alloc_init_late(), before zone contiguity is evaluated, so later page\nallocator setup only sees valid struct page state.  This also makes the\ninitialization order more natural, as struct pages should be initialized\nbefore later code inspects them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/hugetlb.h","mm/hugetlb.c","mm/mm_init.c","mm/sparse-vmemmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40","lessThan":"326de479ab5942fb4a4aa4f20c716045434fcd6b","versionType":"git","status":"affected"},{"version":"fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40","lessThan":"09505232eced5f1c42902d8f28740f070c3fc6dc","versionType":"git","status":"affected"},{"version":"fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40","lessThan":"29968bc7aefb3cf1e72aa7c5f52697a6b0527094","versionType":"git","status":"affected"},{"version":"fde1c4ecf91640e5a95ec36b71ec2e8ec379ce40","lessThan":"b1b7c045e808c761b1cc8c19b3040fadedda3fef","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/hugetlb.h","mm/hugetlb.c","mm/mm_init.c","mm/sparse-vmemmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/09505232eced5f1c42902d8f28740f070c3fc6dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29968bc7aefb3cf1e72aa7c5f52697a6b0527094","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/326de479ab5942fb4a4aa4f20c716045434fcd6b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1b7c045e808c761b1cc8c19b3040fadedda3fef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93231","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.637","lastModified":"2026-10-21T13:21:05.710","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlockd: fix swapped arguments in nlmsvc_match_ip()\n\nWhen releasing locks by server IP address via /proc/fs/nfsd/unlock_ip,\nnlmsvc_unlock_all_by_ip() calls nlm_traverse_files() with the server\nsockaddr as the opaque @data argument:\n\n\tnlm_traverse_files(server_addr, nlmsvc_match_ip, NULL);\n\nThe match callback is later invoked from nlm_traverse_locks() as:\n\n\tmatch(lockhost, host);\n\nwhere the first argument is the nlm_host that owns the lock, and the\nsecond argument is the @data that was originally passed down (here the\nserver sockaddr).  This is the convention every other match callback\nrelies on (nlmsvc_mark_host(), nlmsvc_same_host(), nlmsvc_is_client()):\narg1 is the real nlm_host, arg2 is the caller-supplied reference value.\n\nnlmsvc_match_ip() has had these two arguments reversed ever since the\nunlock-by-IP feature was introduced in commit 4373ea84c84d (\"lockd:\nunlock lockd locks associated with a given server ip\"):\n\n\treturn rpc_cmp_addr(nlm_srcaddr(host), datap);\n\nHere @host is actually the server sockaddr, so nlm_srcaddr(host)\ndereferences a struct sockaddr as a struct nlm_host and reads garbage\nat the offset of h_srcaddr; meanwhile @datap is actually the lock\nowner's nlm_host but is compared as a sockaddr.  As a result the\ncomparison practically never matches and locks are not released for the\nrequested IP.\n\nSwap the arguments so the lock owner's source address is compared\nagainst the requested server address:\n\n\treturn rpc_cmp_addr(nlm_srcaddr(datap), (struct sockaddr *)host);\n\n[ cel: fix the misleading typedef parameter names too ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/lockd/lockd.h","fs/lockd/svcsubs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"4fe2db296c9cd897dd1fe06cc0ae9cbc13beefc5","versionType":"git","status":"affected"},{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"d34c2ac447fe0490ede828e0143e2cbcb59e6c77","versionType":"git","status":"affected"},{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"0d72e78c9d38d5377a059a4837f82b65b91cdcf6","versionType":"git","status":"affected"},{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"21bcb609e0ab1dd60f39ca3498f85808933bcc9f","versionType":"git","status":"affected"},{"version":"4373ea84c84d8a96e99d3da99e813d3e36d1bd11","lessThan":"b9060689f49dc663e9a3d069c4a65ff63a836e66","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/lockd/lockd.h","fs/lockd/svcsubs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.26","status":"affected"},{"version":"0","lessThan":"2.6.26","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0d72e78c9d38d5377a059a4837f82b65b91cdcf6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21bcb609e0ab1dd60f39ca3498f85808933bcc9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4fe2db296c9cd897dd1fe06cc0ae9cbc13beefc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9060689f49dc663e9a3d069c4a65ff63a836e66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d34c2ac447fe0490ede828e0143e2cbcb59e6c77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93232","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.767","lastModified":"2026-10-19T10:17:14.263","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pages\n\nPatch series \"mm: Refactor bootmem gigantic hugepage allocation\", v4.\n\nThis series is split out from the earlier larger series \"mm: Generalize\nHVO for HugeTLB and device DAX\" [1].  It collects the first 19 patches of\nthat series as a standalone set of fixes and preparatory cleanups around\nbootmem HugeTLB handling, sparse initialization ordering, and related\nvmemmap setup.\n\nThe first patches fix a few bugs found while reviewing the existing code,\nincluding incorrect bootmem HVO handling, wrong vmemmap registration\narguments, a powerpc compound-vmemmap tracking bug, and too-late\ninitialization of gigantic bootmem HugeTLB struct pages.\n\nThe rest of the series reorders early memory initialization so the\nrelevant zone state is available before sparse and HugeTLB boot-time setup\nruns, then simplifies the remaining bootmem gigantic hugepage allocation\npath and removes code made obsolete by that rework.\n\nAt a high level:\n  - patches [1-4] fix boot-time and arch-specific bugs\n  - patches [5-12] reorder and simplify sparse/mm/hugetlb early init\n  - patches [13-19] refactor bootmem gigantic hugepage allocation and\n    remove obsolete helpers and state\n\n\nThis patch (of 19):\n\nCommit 622026e87c40 (\"mm/hugetlb: remove fake head pages\") switched\nHVO to reuse per-zone shared tail pages from zone->vmemmap_tails[].\n\nThose shared tail pages were initialized in hugetlb_vmemmap_init(), but\nbootmem HugeTLB folios are prepared earlier from\ngather_bootmem_prealloc().  With hugetlb_free_vmemmap=on,\nprep_and_add_bootmem_folios() can access pageblock flags on bootmem\nHugeTLB pages whose mirrored tail struct pages already point to the shared\ntail page.  On CONFIG_DEBUG_VM kernels, get_pfnblock_bitmap_bitidx() then\ndereferences the still-uninitialized shared tail page and can panic during\nboot.\n\nInitialize zone->vmemmap_tails[] from gather_bootmem_prealloc(), before\nbootmem HugeTLB folios are processed, and drop the later initialization\nfrom hugetlb_vmemmap_init().\n\nThis bug only affects CONFIG_DEBUG_VM kernels, where the relevant\nassertion is evaluated."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/hugetlb.c","mm/hugetlb_vmemmap.c","mm/sparse-vmemmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"622026e87c4019e609010811757e31193cc23847","lessThan":"2ddf429e25cf8415d9c308f07e64012026bd4d77","versionType":"git","status":"affected"},{"version":"622026e87c4019e609010811757e31193cc23847","lessThan":"c0caeceb0c3899dc42844d3979093b27d1434108","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/hugetlb.c","mm/hugetlb_vmemmap.c","mm/sparse-vmemmap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.4","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2ddf429e25cf8415d9c308f07e64012026bd4d77","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0caeceb0c3899dc42844d3979093b27d1434108","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93233","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:18.887","lastModified":"2026-10-19T10:17:14.360","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/nouveau/dmem: fix callocated underflow on large folio split\n\nnouveau_dmem_folio_free() drops chunk->callocated once per freed folio,\nwhile a large (compound) device-private folio is only counted once when\nit is allocated.  When such a folio is split, the mm core invokes\n->folio_split() (nouveau_dmem_folio_split()) once for each new\nsub-folio, but the hook only fixes up the sub-folio metadata and leaves\nchunk->callocated unchanged.\n\nEach resulting sub-folio is later freed separately, so after a split\nthe single allocation (+1) is met by N frees (-N), leaving\nchunk->callocated short by N-1.  On the first split/free cycle it\nunderflows: WARN_ON(!chunk->callocated) fires, the unsigned counter\nwraps and never returns to zero, so the chunk can no longer be\nreclaimed (nouveau_dmem_fini() also warns on the leaked count).\n\nAccount for the new sub-folio in the split hook, under the same lock as\nnouveau_dmem_folio_free(), so the count stays balanced."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/nouveau/nouveau_dmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c3228747107705d47c7e9a03598a434a0380cb73","lessThan":"0163b92946d0a7c816f619c57a4d9867954dd106","versionType":"git","status":"affected"},{"version":"c3228747107705d47c7e9a03598a434a0380cb73","lessThan":"c2256c044a1df39c8aad4dd2d6f709b2533e2d7a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/nouveau/nouveau_dmem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0163b92946d0a7c816f619c57a4d9867954dd106","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2256c044a1df39c8aad4dd2d6f709b2533e2d7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93234","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.007","lastModified":"2026-10-19T10:17:14.443","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/gud: validate TV mode names before creating enum property\n\nThe GUD protocol returns TV mode names as fixed-size\nGUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be\nNUL-terminated.\n\ngud_connector_add_tv_mode() currently passes each fixed-size entry\ndirectly to drm_mode_create_tv_properties_legacy(), which eventually\nreaches drm_property_add_enum() and strlen(). If a device returns an\nentry without a terminating NUL byte, strlen() reads past the end of\nthe slot and can run beyond the allocated buffer, triggering an\nout-of-bounds read.\n\nValidate that each returned TV mode name contains a NUL terminator\nwithin its fixed-size slot before passing it to the DRM property code.\nIf a malformed entry is found, reject the device response with -EIO.\n\nThis fixes the out-of-bounds read without changing the handling of\nvalid devices, and avoids silently truncating malformed protocol data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/gud/gud_connector.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"676f1fb3632bbc9ce83be7938e93fe6bfc9510fd","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"06fcaf21c18ac88f57fee3803554f48c6026b95f","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"082e378886547b5b1c4075ed307f7c68547868dc","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"70cffc31a380b3eae45027101647aa94c242aa0e","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"72a95df6bbc7d20c7af1e39d86b3e910cccd01ad","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"eab46d9629807db1b5647d17227e16110a18227f","versionType":"git","status":"affected"},{"version":"40e1a70b4aedf2859a1829991b48ef0ebe650bf2","lessThan":"da1ea35fea67ad841f4ada28dd61b41be65e5437","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/gud/gud_connector.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/676f1fb3632bbc9ce83be7938e93fe6bfc9510fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/70cffc31a380b3eae45027101647aa94c242aa0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72a95df6bbc7d20c7af1e39d86b3e910cccd01ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da1ea35fea67ad841f4ada28dd61b41be65e5437","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eab46d9629807db1b5647d17227e16110a18227f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93235","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.150","lastModified":"2026-10-19T10:17:14.553","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to zero post-EOF data when extending file size\n\ngeneric/794  4s ... - output mismatch (see /share/git/fstests/results//generic/794.out.bad)\n    --- tests/generic/794.out   2026-06-12 08:46:32.766426241 +0800\n    +++ /share/git/fstests/results//generic/794.out.bad 2026-07-05 18:32:55.000000000 +0800\n    @@ -1,4 +1,16 @@\n     QA output created by 794\n     append_write\n    +FAIL: non-zero data in gap [4080,4096) after shutdown+remount\n    +000000 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a  >ZZZZZZZZZZZZZZZZ<\n    +*\n    +001000\n     truncate_up\n    ...\n    (Run 'diff -u /share/git/fstests/tests/generic/794.out /share/git/fstests/results//generic/794.out.bad'  to see the entire diff)\nRan: generic/794\nFailures: generic/794\nFailed 1 of 1 tests\n\nSteps of generic/794:\n1. write 4096 bytes to file w/ 0x5a\n2. use fiemap to get PBA of first block in file\n3. truncate file to 4080\n4. umount; write 4096 bytes to file w/ 0x5a directly via PBA; mount\n5. extend filesize via\n   a) append 4096 from offset 4096, or\n   b) truncate 8192, or\n   c) fallocate 4096 from offset 4096\n6. verify the gap is zeroed in memory [4080,4096)\n7. sync range 4096 from offset 4096; shutdown -f (flush meta before shutdown)\n8. umount; mount; verify [4080,4096) is zeroed or not.\n\nWhen extending file size (e.g. via truncate, fallocate, or write) across an\nunaligned EOF boundary, we need to ensure that post-EOF data in the partial\npage is zeroed out in pagecache and marked dirty, then writeback the cache to\npersist zeroed data before committing inode w/ updated i_size.\n\nThis help to prevent stale disk data beyond the previous EOF from being exposed\nafter remounting or crash recovery.\n\nSince f2fs is a LFS filesystem, we only support direct write via PBA in pinfile,\nand pinfile has section-aligned filesize, so in Android, there should no problem,\nbut for other usage in different environment, let's fix this w/ fsync_mode=strict\nmount option."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/f2fs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"6882d458d2e403f6ba7b45542dd31a6b7531eb2e","versionType":"git","status":"affected"},{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"32c7f11a24268ba8d3bb50ea7f54d33f698cd253","versionType":"git","status":"affected"},{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"91ec55ddc097ccddd25ffb95a3d079b2ef362372","versionType":"git","status":"affected"},{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"c42608c09b6b5d5967bf211c255914c068c2cde1","versionType":"git","status":"affected"},{"version":"fbfa2cc58d5363f780f4f2ad0243a47185c2bb2a","lessThan":"5eced87b7d19dbc76ebdddaf322046f9ac582fcb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/f2fs/file.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/32c7f11a24268ba8d3bb50ea7f54d33f698cd253","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5eced87b7d19dbc76ebdddaf322046f9ac582fcb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6882d458d2e403f6ba7b45542dd31a6b7531eb2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91ec55ddc097ccddd25ffb95a3d079b2ef362372","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c42608c09b6b5d5967bf211c255914c068c2cde1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93236","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.297","lastModified":"2026-10-19T10:17:14.663","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common\n\nWhen VIDIOC_TRY_FMT is called with an unsupported pixel format on the\nOUTPUT queue, vdec_try_fmt_common() falls back to V4L2_PIX_FMT_MPEG2.\nHowever, if a distro has locally patched MPEG2 support out (as it has\nbeen broken for some time) the platform format table does not contain\nMPEG2 so find_format() returns NULL and the subsequent dereference of\nfmt_out->max_width triggers a NULL pointer dereference.\n\nFix this by falling back to the first format in the platform's format\narray instead of hardcoding V4L2_PIX_FMT_MPEG2. This is always valid\nsince every platform defines at least one format."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/media/meson/vdec/vdec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"276f28672bb6d5d5feca78db4219c7b5adf1be26","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"c620906fb1b2ad75d408ea9d06040d66952d4a31","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"3839b6be2279fc4f558723f2c0fbfc9c42070958","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"680a89683197cdfe4e03e6fd7755454c647d39c1","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"f2375a308640e401c142c5426d52c3d10e016d25","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"96dafbae77f50bfe2228bcfedcd8652c5e5f08e8","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"d61ba609c3226af3c84268ba606ea06ee63e511b","versionType":"git","status":"affected"},{"version":"3e7f51bd96077acad6acd7b45668f65b44233c4e","lessThan":"20aa934ace6917262ff579a73ec018d06a7bad1c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/media/meson/vdec/vdec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20aa934ace6917262ff579a73ec018d06a7bad1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/276f28672bb6d5d5feca78db4219c7b5adf1be26","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3839b6be2279fc4f558723f2c0fbfc9c42070958","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/680a89683197cdfe4e03e6fd7755454c647d39c1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96dafbae77f50bfe2228bcfedcd8652c5e5f08e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c620906fb1b2ad75d408ea9d06040d66952d4a31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d61ba609c3226af3c84268ba606ea06ee63e511b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2375a308640e401c142c5426d52c3d10e016d25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93237","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.447","lastModified":"2026-10-19T10:17:14.793","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: Add DIRECT_MAP_PHYSMEM_END definition\n\nget_free_mem_region() and mhp_get_pluggable_range() bound their search\nto DIRECT_MAP_PHYSMEM_END. LoongArch does not define it, so the fallback\nin include/linux/mm.h applies: under CONFIG_SPARSEMEM_VMEMMAP it is\n(1ULL << MAX_PHYSMEM_BITS) - 1, a compile-time constant that does not\nadapt to the CPU's physical address space bits (cpu_pabits, probed from\nCPUCFG1).\n\nThe vmemmap window only covers physical space below 2^(cpu_pabits+1)\n(i.e. VMEMMAP_SIZE), so on CPUs with fewer physical address bits than\nMAX_PHYSMEM_BITS the fallback allows get_free_mem_region() to return\na ZONE_DEVICE region outside the vmemmap window; vmemmap_populate() then\nwraps the memmap range around and maps it into low memory, silently\ncorrupting the page tables. The same search also picked the top-of-\naddress-space region that crashed memmap_init_zone_device() with amdkfd\non Loongson-3C6000 in 6.16 [1]; the commit 2969b42c8f99 (\"LoongArch/mm:\nalign vmemmap to maximal folio size\") keeps that region in bounds on\ncurrent Loongson-3C6000 configs, but CPUs with smaller cpu_pabits (e.g.\nthe Loongson-2K series) are still affected.\n\nDefine DIRECT_MAP_PHYSMEM_END as the vmemmap-covered physical range,\n(1ULL << (cpu_pabits + 1)) - 1, capped at (1ULL << MAX_PHYSMEM_BITS) - 1\nunder CONFIG_SPARSEMEM, similar to the commit f3336b48cf9d (\"riscv: mm:\nDefine DIRECT_MAP_PHYSMEM_END\").\n\n[1] https://lore.kernel.org/amd-gfx/20250814032153.227285-1-jeffbai@aosc.io/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/loongarch/include/asm/pgtable.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7b09f5af01ede480cbe7abcb281cf17550a46ff5","lessThan":"ab275a23b4d9f04ca6c2f5f6a3246194e045a761","versionType":"git","status":"affected"},{"version":"7b09f5af01ede480cbe7abcb281cf17550a46ff5","lessThan":"55e18311c705cceef6c34d522ea387b1f0069bab","versionType":"git","status":"affected"},{"version":"7b09f5af01ede480cbe7abcb281cf17550a46ff5","lessThan":"2677f97a67fdbc62a82ce1faa67791f54451d36f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/loongarch/include/asm/pgtable.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2677f97a67fdbc62a82ce1faa67791f54451d36f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55e18311c705cceef6c34d522ea387b1f0069bab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab275a23b4d9f04ca6c2f5f6a3246194e045a761","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93238","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.563","lastModified":"2026-10-19T10:17:14.913","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap\n\nThe DECLARE_BITMAP(apm_filtered, AP_DEVICES) macro allocates the bitmap\non the stack without zero-initializing it.\n\nIn vfio_ap_mdev_hot_plug_cfg(), the vfio_ap_mdev_filter_matrix() function\nis only called to initialize and populate apm_filtered if either\nfilter_adapters or filter_domains is true. If the hot plug configuration\nchange only adds control domains (meaning filter_cdoms is true, but\nfilter_adapters and filter_domains are both false),\nvfio_ap_mdev_filter_matrix() is bypassed.\n\nConsequently, apm_filtered is passed to reset_queues_for_apids() with\nuninitialized stack garbage. This can cause reset_queues_for_apids() to\ninterpret arbitrary stack garbage bits as valid APIDs to reset, potentially\nperforming unintended guest hardware queue resets.\n\nFix this by zero-initializing the apm_filtered bitmap at the beginning of\nvfio_ap_mdev_hot_plug_cfg() using bitmap_zero()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/s390/crypto/vfio_ap_ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2","versionType":"git","status":"affected"},{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"f73db632524320d2b93bc8534be8ea875053502d","versionType":"git","status":"affected"},{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"6d554f2571e6b4db242593ba561efd6a6d1f99a9","versionType":"git","status":"affected"},{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"09548edc6114f1eb1035b30795e893204ef45b85","versionType":"git","status":"affected"},{"version":"eeb386aeb5b7c8d2dae6a3ba49255d8a97803182","lessThan":"bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/s390/crypto/vfio_ap_ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/09548edc6114f1eb1035b30795e893204ef45b85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4ba8a08f5f26ed59f356a6318bca3aa7cc0af3e2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d554f2571e6b4db242593ba561efd6a6d1f99a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf09b9d7cd7890bc3a3b7eb63d5ece15f88bfde7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f73db632524320d2b93bc8534be8ea875053502d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93239","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.690","lastModified":"2026-10-19T10:17:15.017","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: mm: Fix the lockless page-table walk in show_pte()\n\nshow_pte() walks page tables locklessly and can run with interrupts\nenabled. A concurrent teardown can free a table page while it is being\nwalked. It can also clear a parent entry after show_pte() checked it; the\nregular pXd_offset() helpers then reread the cleared entry and can derive a\nbogus lower-level pointer and fault again.\n\nUse the lockless offset helpers with the saved parent entries, as\ngup_fast() does, and pass the saved PMD to pte_offset_map().\n\nFor task page tables, arm64 selects MMU_GATHER_RCU_TABLE_FREE. Disable\nlocal interrupts around the walk to hold off RCU-deferred table frees and\nblock the tlb_remove_table_sync_one() IPI until the walk is finished.\n\nPlace the IRQ guard after the header print. This does not make the output a\nconsistent snapshot, but prevents the task page-table walk from\ndereferencing a released table page or deriving a pointer from a different\nparent value."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/mm/fault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"08d931a0a850ad16a64f2cd23a19f40795cdbdf7","versionType":"git","status":"affected"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"b28fe65a36b8209b6adcf2722c7ce974cf9ac8d1","versionType":"git","status":"affected"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"68cbd70795dd8c06e7ccdc4eb0b74c5b180076c3","versionType":"git","status":"affected"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"0f05d95b99164a9ccc4cf4a4920e0ff0228138ad","versionType":"git","status":"affected"},{"version":"1d18c47c735e8adfe531fc41fae31e98f86b68fe","lessThan":"a77644d009dece1104b6fcc6e322b0e4503db0d6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/mm/fault.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.7","status":"affected"},{"version":"0","lessThan":"3.7","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/08d931a0a850ad16a64f2cd23a19f40795cdbdf7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0f05d95b99164a9ccc4cf4a4920e0ff0228138ad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68cbd70795dd8c06e7ccdc4eb0b74c5b180076c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a77644d009dece1104b6fcc6e322b0e4503db0d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b28fe65a36b8209b6adcf2722c7ce974cf9ac8d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93240","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.827","lastModified":"2026-10-21T13:21:05.993","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: make the v1 soft limit knob inert\n\nThe v1 soft limit has been deprecated since v6.12 and nobody has reported\ndepending on it.  Start the removal by decoupling the interface from the\nimplementation: keep memory.soft_limit_in_bytes, but ignore writes to it\nand always report the maximum value on read similar to what\nmemory.kmem.limit_in_bytes already does.\n\nWrites are still parsed, so malformed input keeps returning -EINVAL.  The\nknob now also behaves the same everywhere: it used to return -EOPNOTSUPP\non PREEMPT_RT, where soft limit reclaim has always been disabled.\n\nThis also fixes the syzbot report linked below.  Soft limit reclaim is the\nonly caller that runs shrink_lruvec() from kswapd against a specific\nmemcg, so it is the only way to reach lru_gen_shrink_lruvec() and in turn\nset_mm_walk(), which warns when called from kswapd."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/admin-guide/cgroup-v1/memory.rst","mm/memcontrol-v1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"bf75f14d755f9cfbb246e6cc011b53cdd5142de3","versionType":"git","status":"affected"},{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"72fb67f6e0e5d78e4f34cf9929d1afdb0fd54203","versionType":"git","status":"affected"},{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"0a90e268cce7023f34087bfa4affb42e29ff5f45","versionType":"git","status":"affected"},{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"5ec8f629a300cc40e746d6178f724bdff7683fa7","versionType":"git","status":"affected"},{"version":"e9d4e1ee788097484606c32122f146d802a9c5fb","lessThan":"a3417097fb107cea3358b19bcbb4eb655fd67f8c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/admin-guide/cgroup-v1/memory.rst","mm/memcontrol-v1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.3","status":"affected"},{"version":"0","lessThan":"6.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0a90e268cce7023f34087bfa4affb42e29ff5f45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5ec8f629a300cc40e746d6178f724bdff7683fa7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72fb67f6e0e5d78e4f34cf9929d1afdb0fd54203","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3417097fb107cea3358b19bcbb4eb655fd67f8c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf75f14d755f9cfbb246e6cc011b53cdd5142de3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93241","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:19.953","lastModified":"2026-10-19T10:17:15.210","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmemcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done\n\nAt Meta, we are seeing instances where an OOM killed job is stuck in the\nexit path for several hours.  In one particular case, the job was stuck\nfor more than 8 hours and I had to manually remove the memory.max limits\nto allow the process to exit.\n\nThe job was a single process job and had ~55 GiB memory.max and zswap\nenabled.  It had almost 0 anon in memory and ~111 GiB in zswap compressed\nto ~51 GiB zswap pool (i.e.  almost all of memory.current was zswap). \nNothing was left on the LRUs to reclaim.\n\nOn further inspection, I observed ~20k threads of that process stuck with\nthe following stack:\n\n[<0>] mem_cgroup_out_of_memory+0x4e/0xa0\n[<0>] charge_memcg+0x8bf/0x990\n[<0>] mem_cgroup_swapin_charge_folio+0x4e/0x80\n[<0>] __read_swap_cache_async+0x10c/0x260\n[<0>] swapin_readahead+0x116/0x3f0\n[<0>] do_swap_page+0x13c/0x1ce0\n[<0>] handle_mm_fault+0x61d/0x11f0\n[<0>] do_user_addr_fault+0x3e7/0x6d0\n[<0>] exc_page_fault+0x8f/0x110\n[<0>] asm_exc_page_fault+0x22/0x30\n[<0>] __get_user_8+0x14/0x20\n[<0>] futex_cleanup+0x27/0x1c0\n[<0>] futex_exit_release+0x47/0x60\n[<0>] do_exit+0x107/0x940\n[<0>] do_group_exit+0x81/0xa0\n[<0>] get_signal+0x2b1/0x6e0\n[<0>] arch_do_signal_or_restart+0x1a/0x1c0\n[<0>] exit_to_user_mode_loop+0xa8/0x1c0\n[<0>] do_syscall_64+0x152/0x250\n[<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nIn addition the dmesg was filled with \"Out of memory and no killable\nprocesses...\" messages.\n\nI have no idea why oom reaper was not able to reap/unmap the process.  My\nguess is that since oom reaper tries to acquire mmap_lock in read mode\nlimited number of times and then gives up, there might be a thread of that\nprocess which had mmap_lock in write mode at that time.\n\nMy initial suspicion was the futex_cleanup and kernel page fault causing\ninfinite fault and charge retries but that was put to rest in previous\ndiscussions happened on similar problem [1].\n\nMy current theory is that it is just a simple slow serialization behind\nthe oom_lock.  Unlike page allocator, memcg charge code takes the oom_lock\nwithout the \"try\".  Though memcg oom code uses mutex_lock_killable(), note\nthat in the call stack get_signal() consumes SIGKILL (or\nsigdelset(SIGKILL)) before calling do_group_exit().  So this\nmutex_lock_killable() is just a mutex_lock() here.  Therefore 10s of\nthousands of threads are waiting on oom_lock and one by one they get\n-EFAULT from get_user() in the futex cleanup code and bails out.\n\nDiscussion from [1] led to commit a75ffa26122b (\"memcg, oom: do not bypass\noom killer for dying tasks\") which routes dying tasks into the OOM path\nprecisely so the oom_reaper can reap their mm and free the memory\nasynchronously.  But the reaper is best-effort and one-shot: if it cannot\ntake mmap_lock for read (e.g.  a sibling thread holds it for write) it\nsets MMF_OOM_SKIP and never retries, leaving only the glacial\noom_lock-serialized synchronous drain.\n\nOnce MMF_OOM_SKIP is set there is no more asynchronous reclaim coming for\nthe mm, so a dying task charging against it has nothing left to wait for:\nit frees its memory only once it finishes exiting.  Running reclaim and\nthe (no-victim) OOM killer for it is then pointless, and doing it for 10s\nof thousands of exiting threads is what serializes them behind oom_lock. \nSo before reclaim, if current is an OOM victim whose reaper is done, fail\nthe charge.\n\nReproduced with 20k threads, each parking a robust futex head on its own\nzswapped page, OOM-group-killed while a sibling holds mmap_lock for write\nso the reaper gives up and sets MMF_OOM_SKIP.  Tested on next-20260728 and\nbaseline show ~90 seconds exit time while with the patch the exit time\nreduced to ~3 seconds."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["mm/memcontrol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a75ffa26122bba4a3fa9372aa13b32d7a5590425","lessThan":"801bcbdbfd595cc7f0de95f2802b5596c8971315","versionType":"git","status":"affected"},{"version":"a75ffa26122bba4a3fa9372aa13b32d7a5590425","lessThan":"d44c3c5986c7a4a5f913a813e18cda08a838f91b","versionType":"git","status":"affected"},{"version":"a75ffa26122bba4a3fa9372aa13b32d7a5590425","lessThan":"6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["mm/memcontrol.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6b0d1083364fc8e7cc2f7d1f93ee3ee78f4d52f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/801bcbdbfd595cc7f0de95f2802b5596c8971315","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d44c3c5986c7a4a5f913a813e18cda08a838f91b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93242","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.090","lastModified":"2026-10-19T10:17:15.323","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()\n\nqla24xx_process_response_queue() advances ring_ptr past the head IOCB\nbefore dispatching, so by the time __qla_consume_iocb() runs, ring_ptr\nalready points at the first continuation IOCB. The function however\nlooped purex->entry_count times starting at ring_ptr. As entry_count\nincludes the head, this consumed one entry too many: it stamped\nRESPONSE_PROCESSED on the next, unrelated IOCB and advanced the ring\npast it, silently dropping a legitimate firmware response. The head\nIOCB's signature was also never marked.\n\nMark the head processed and account for it, then consume only the\nentry_count - 1 continuation IOCBs, matching __qla_copy_purex_to_buffer()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/qla2xxx/qla_isr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"a136c311676fd1010b1bde3bcfd410caa2fa040f","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"d841707fafba5f80341b82e8c3a4c24fc5aa5132","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"6e3f129538c32d0019437197735912308c161843","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"bd1534d4afab47f13dfc27fff6f59dd859a0ac3a","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"31715d1e1cbf3a37ce3452635c5602f73fd7abd4","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"df86c27cf1ba9d66f737a1fa56479c6e7efafe4e","versionType":"git","status":"affected"},{"version":"fac2807946c10b9a509b9c348afd442fa823c5f7","lessThan":"3ba019bdd89d931499d9476456b5d9c7ab7fa753","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/qla2xxx/qla_isr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/31715d1e1cbf3a37ce3452635c5602f73fd7abd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ba019bdd89d931499d9476456b5d9c7ab7fa753","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e3f129538c32d0019437197735912308c161843","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a136c311676fd1010b1bde3bcfd410caa2fa040f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd1534d4afab47f13dfc27fff6f59dd859a0ac3a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d841707fafba5f80341b82e8c3a4c24fc5aa5132","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df86c27cf1ba9d66f737a1fa56479c6e7efafe4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93243","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.230","lastModified":"2026-10-21T13:21:06.283","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmm/secretmem: properly account locked pages\n\nsecretmem accounts folios by treating memory as if it were mlock()'d and\nthus limited by the RLIMIT_MEMLOCK limit.\n\nHowever the folios are unevictable and remain so until the inode is\nevicted, eliminating usual mlock() semantics - mapping folios then\nunmapping them does not clear their unevictable state, since it depends on\nAS_UNEVICTABLE, not PG_mlocked.\n\nA user can therefore easily work around the RLIMIT_MEMLOCK limit - simply\nmap then unmap and VmLck no longer counts the secretmem range.  Worse,\nfolios are not accounted in the process's RSS, meaning the OOM killer\nwon't know to kill the process.\n\nRepeatedly mapping/unmapping (or forking) can then result in the\nconsumption of all available system memory with unevictable folios and\ncause system instability.\n\nA secretmem fd can be passed between processes and over fork so a\nper-process limit simply does not make sense, so follow the precedent set\nby io_uring, perf, skbuff, iommufd and xdp by tracking the number of\nlocked pages in user_struct->locked_vm.\n\nSince the scope tracked is actually inode lifetime, the RLIMIT_MEMLOCK\napplies per-user not per-process, so it doesn't make sense to bypass for\nusers with CAP_IPC_LOCK, therefore remove this bypass.\n\nThere is simply no reason to carry on marking the mapping as mlock()'d\nsince it's misleading and the lifecycle is now correctly handled, so\nremove this too.\n\nNote that secretmem does not support any form of truncation (including\nhole punching) and the folios are unreclaimable, so the folios need only\nbe accounted on fault and unaccounted on inode destruction.\n\n__secretmem_account_pages() is more or less a duplicate of the code that\nio_uring etc.  use, but since this is a bug fix that needs backporting,\ndefer any de-duplication efforts to a follow-up.\n\ntest_mlock_limit() asserts mlock_future_ok() on mmap(), however this has\nbeen removed, so remove the test altogether for the fix.  A new test will\nbe sent separately for upstream."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/sched/user.h","mm/secretmem.c","tools/testing/selftests/mm/memfd_secret.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"51fba083e454f901947d6a335eeff671171d4714","versionType":"git","status":"affected"},{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"a41c95ac90f285cbe473b9606428b14518896ea4","versionType":"git","status":"affected"},{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"853043cb129473ff2fa0090602be944d96b9d5c9","versionType":"git","status":"affected"},{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"3b4f72bdddff69819d665395376329ef21f37a06","versionType":"git","status":"affected"},{"version":"1507f51255c9ff07d75909a84e7c0d7f3c4b2f49","lessThan":"97d34aa65c29cca85e3e9050f4c936389b38a054","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/sched/user.h","mm/secretmem.c","tools/testing/selftests/mm/memfd_secret.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3b4f72bdddff69819d665395376329ef21f37a06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51fba083e454f901947d6a335eeff671171d4714","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/853043cb129473ff2fa0090602be944d96b9d5c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97d34aa65c29cca85e3e9050f4c936389b38a054","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a41c95ac90f285cbe473b9606428b14518896ea4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93244","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.360","lastModified":"2026-10-21T13:21:06.577","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/sysfb: simpledrm: Improve stride validation\n\nValidate the computed stride against the maximum value INT_MAX."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/sysfb/simpledrm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"110dd054fd4af97fc3f47d7df9a016b07122cc04","versionType":"git","status":"affected"},{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"b09d27caf49ff584dbafdba3bb95487a75cb8824","versionType":"git","status":"affected"},{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"6892f0a2f6b5990b9572ba043dd14dd4df6bb3f0","versionType":"git","status":"affected"},{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"bbdc6761c55662fb9ddf5ab580acb616131998fe","versionType":"git","status":"affected"},{"version":"7bfa5c7b28d66d89daf0808bf36ab7fe0e9e93a1","lessThan":"df6533f11688aa30be3bb883c7637f4ffdbb7cbd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/sysfb/simpledrm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.51","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/110dd054fd4af97fc3f47d7df9a016b07122cc04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6892f0a2f6b5990b9572ba043dd14dd4df6bb3f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b09d27caf49ff584dbafdba3bb95487a75cb8824","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbdc6761c55662fb9ddf5ab580acb616131998fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df6533f11688aa30be3bb883c7637f4ffdbb7cbd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93245","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.473","lastModified":"2026-10-19T10:17:15.633","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\napparmor: policy_int make sure list heads are initialized before fail path\n\nIf profile create fails before policy_init is complete the list heads\nare not properly initialized causing profile_free() sanity checks to\ntrigger the following splat.\n\nAppArmor WARN aa_policy_destroy: (((!list_empty(&policy->profiles) && (&policy->profiles)->prev != ((void *) 0x122 + (0xdead000000000000UL))))):\nWARNING: security/apparmor/lib.c:509 at aa_policy_destroy+0x164/0x1b0 security/apparmor/lib.c:509, CPU#0: syz.0.17/5541\nModules linked in:\nCPU: 0 UID: 0 PID: 5541 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nRIP: 0010:aa_policy_destroy+0x16b/0x1b0 security/apparmor/lib.c:509\nCode: 85 ed 7e 4d e8 96 bc 37 fd 5b 41 5c 41 5e 41 5f 5d e9 19 27 4e 07 cc e8 83 bc 37 fd 48 8d 3d 0c f0 d3 0b 48 c7 c6 a4 eb 38 8e <67> 48 0f b9 3a e9 04 ff ff ff e8 66 bc 37 fd 48 8d 3d ff ef d3 0b\nRSP: 0018:ffffc9000345eaa0 EFLAGS: 00010293\nRAX: ffffffff848f530d RBX: ffff88803f734800 RCX: ffff88801af2a580\nRDX: 0000000000000000 RSI: ffffffff8e38eba4 RDI: ffffffff90634320\nRBP: 0000000000000000 R08: 0000000000000cc0 R09: 00000000ffffffff\nR10: dffffc0000000000 R11: fffffbfff1d95913 R12: dead000000000122\nR13: ffff88803f734800 R14: ffff88803f734828 R15: dffffc0000000000\nFS:  00007f5f6a1836c0(0000) GS:ffff88808c519000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000055d02407b048 CR3: 0000000012aa9000 CR4: 0000000000352ef0\nCall Trace:\n <TASK>\n aa_free_profile+0x9d/0x9f0 security/apparmor/policy.c:334\n aa_alloc_profile+0x1e4/0x3e0 security/apparmor/policy.c:416\n unpack_profile security/apparmor/policy_unpack.c:1153 [inline]\n aa_unpack+0x17db/0x7430 security/apparmor/policy_unpack.c:1748\n aa_replace_profiles+0x226/0x2a20 security/apparmor/policy.c:1183\n policy_update+0x234/0x4a0 security/apparmor/apparmorfs.c:505\n profile_load+0x1cb/0x320 security/apparmor/apparmorfs.c:522\n vfs_write+0x296/0xba0 fs/read_write.c:685\n ksys_write+0x150/0x270 fs/read_write.c:739\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f5f6939e0d9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f5f6a183028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 00007f5f69625fa0 RCX: 00007f5f6939e0d9\nRDX: 0000000000000041 RSI: 0000200000000400 RDI: 0000000000000003\nRBP: 00007f5f6a183090 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001\nR13: 00007f5f69626038 R14: 00007f5f69625fa0 R15: 00007ffe23725c18"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["security/apparmor/lib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"88ba930e7d0586ca2700757249f1e6fc0bbab0fc","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"ee017ef9aa2cf20d85d4a20c09ef3db9fb240310","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"62f159fac76468dbbfd977f4f18472d4a01e8d74","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"0664c75afe87a1d7d4f4e1d7eecf50ad829fb6e8","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"4a09a5e6512a3792c78ae8e3ca79cb55a11eed57","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"5449f715f24e86648f8cc8fba8d97ff6b5d04981","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"dd52ab1c5436be86f5b8ca118fa8e5d61d63ffed","versionType":"git","status":"affected"},{"version":"fe6bb31f590c9cd9c8d3ddbdfd4301f72db91718","lessThan":"3daad923a8685adb66087e0d819559b7eb6ba975","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["security/apparmor/lib.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.11","status":"affected"},{"version":"0","lessThan":"4.11","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0664c75afe87a1d7d4f4e1d7eecf50ad829fb6e8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3daad923a8685adb66087e0d819559b7eb6ba975","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a09a5e6512a3792c78ae8e3ca79cb55a11eed57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5449f715f24e86648f8cc8fba8d97ff6b5d04981","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62f159fac76468dbbfd977f4f18472d4a01e8d74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/88ba930e7d0586ca2700757249f1e6fc0bbab0fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd52ab1c5436be86f5b8ca118fa8e5d61d63ffed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee017ef9aa2cf20d85d4a20c09ef3db9fb240310","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93246","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.647","lastModified":"2026-10-19T10:17:15.767","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-af: fix out-of-bounds read setting MSI-X irq affinity\n\nrvu_register_interrupts() walks every MSI-X vector and uses strstr()\nto match \"Mbox\" or \"FLR\" in irq_name before pinning those interrupts\nto CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every\nslot is populated before this loop runs. strstr() keeps scanning until\nit finds a NUL terminator, so an uninitialized slot can trigger a KASAN\nslab-out-of-bounds read at boot when debug options are enabled.\n\nUse strnstr() with NAME_SIZE to bound the search within each vector's\nname buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4e527f1e5c155ce28164ba34cad47b635d16f827","lessThan":"2f460aa0211e97c011ef0cfe5016f8f2a2ed059b","versionType":"git","status":"affected"},{"version":"4e527f1e5c155ce28164ba34cad47b635d16f827","lessThan":"4d5df98369c5f45710b786499f8bd7ffc3196433","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/marvell/octeontx2/af/rvu.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2f460aa0211e97c011ef0cfe5016f8f2a2ed059b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d5df98369c5f45710b786499f8bd7ffc3196433","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93247","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.803","lastModified":"2026-10-19T10:17:15.900","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference\n\n'uuid_count' member of struct 'discovery_state' is assigned and read\nwithout any locks, so there is a chance of situation when\nuuid_count != 0, but uuids is NULL and there will be NULL pointer\ndereference.\n\nPossible race:\n'hci_update_passive_scan_sync'\n  'hci_discovery_filter_clear'\n    hdev->discovery.uuid_count = 0;\n      <----------------------preempted----------------------------->\n                        'start_service_discovery'\n                          // Set uuid_count to value != 0\n                          hdev->discovery.uuid_count = uuid_count;\n                          hdev->discovery.uuids = kmemdup(...);\n      <----------------------preempted----------------------------->\n    spin_lock(&hdev->discovery.lock);\n    kfree(hdev->discovery.uuids);\n    hdev->discovery.uuids = NULL;\n    spin_unlock(&hdev->discovery.lock);\n\nNow uuids == NULL and uuid_count != 0.\nSo 'mgmt_device_found' -> 'is_filter_match' -> 'eir_has_uuids' receives\nnon consistent discovery state, where NULL dereference of uuids happens.\n\nTo fix it let's add discovery.lock around every read/write of uuid_count,\nuuids pair of struct members. It is also important to assign uuid_count\nvalue only after success kmemdup() allocation in\nstart_service_discovery(), otherwise uuids is NULL, because kmemdup failed,\nbut uuid_count is already assigned to non zero value.\n\nThe following panic happens:\n\n[ ] ------------[ cut here ]------------\n[ ] Unable to handle kernel NULL pointer dereference at virtual\naddress 0000000000000000\n[ ] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP\n[ ] CPU: 0 PID: 15056 Comm: kworker/u9:2\n[ ] Workqueue: hci0 hci_rx_work\n[ ] pstate: 10400009 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)\n[ ] pc : eir_has_uuids+0x2d8/0x590\n[ ] lr : is_filter_match+0x258/0x320\n...\n[ ] Call trace:\n[ ]  eir_has_uuids+0x2d8/0x590\n[ ]  is_filter_match+0x258/0x320\n[ ]  mgmt_device_found+0x5b0/0xafc\n[ ]  process_adv_report.part.0+0x8c8/0xf14\n[ ]  hci_le_adv_report_evt+0x338/0x3f0\n[ ]  hci_le_meta_evt+0x1f0/0x4c8\n[ ]  hci_event_packet+0x440/0xc9c\n[ ]  hci_rx_work+0x44c/0xaf8\n[ ]  process_one_work+0x54c/0x103c\n[ ]  worker_thread+0x6c4/0x10c4\n[ ]  kthread+0x274/0x2ec\n[ ]  ret_from_fork+0x10/0x20\n[ ] Code: 14000004 91004021 eb14003f 54000180 (f9400024)\n[ ] ---[ end trace 0000000000000000 ]---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/net/bluetooth/hci_core.h","net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"86f3dcd1f331cfd4fd7ec88906955134ec51afbe","lessThan":"f02c01ccd12cb2b8a290077d4c90f29a6e109b16","versionType":"git","status":"affected"},{"version":"7ce9bb0b95fc280e9212b8922590c492ca1d9c39","lessThan":"bbd262d2d750b67b15a5e1008d3848309c87e7a7","versionType":"git","status":"affected"},{"version":"16852eccbdfaf41a666705e3f8be55cf2864c5ca","lessThan":"18fda026a13c5abd6c1e0dfd3549f490b73378fb","versionType":"git","status":"affected"},{"version":"2935e556850e9c94d7a00adf14d3cd7fe406ac03","lessThan":"c3f63610bceaa182e4683b23cc47baf36b5f1496","versionType":"git","status":"affected"},{"version":"2935e556850e9c94d7a00adf14d3cd7fe406ac03","lessThan":"ee2135a14fb2a3e176149122764d293f0796b1eb","versionType":"git","status":"affected"},{"version":"2935e556850e9c94d7a00adf14d3cd7fe406ac03","lessThan":"59eecbe2f2f38d8f3e1104bd11da97f9a2c58998","versionType":"git","status":"affected"},{"version":"a351ff6b8ecca4229afaa0d98042bead8de64799","versionType":"git","status":"affected"},{"version":"f8069f34c4c976786ded97498012225af87435d7","versionType":"git","status":"affected"},{"version":"6.1.159","lessThan":"6.1.188","versionType":"semver","status":"affected"},{"version":"6.6.117","lessThan":"6.6.157","versionType":"semver","status":"affected"},{"version":"6.12.42","lessThan":"6.12.110","versionType":"semver","status":"affected"},{"version":"6.15.10","lessThan":"6.16","versionType":"semver","status":"affected"},{"version":"6.16.1","lessThan":"6.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/net/bluetooth/hci_core.h","net/bluetooth/mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/18fda026a13c5abd6c1e0dfd3549f490b73378fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59eecbe2f2f38d8f3e1104bd11da97f9a2c58998","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbd262d2d750b67b15a5e1008d3848309c87e7a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3f63610bceaa182e4683b23cc47baf36b5f1496","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee2135a14fb2a3e176149122764d293f0796b1eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f02c01ccd12cb2b8a290077d4c90f29a6e109b16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93248","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:20.963","lastModified":"2026-10-19T10:17:16.030","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: don't WARN on kernel job timeout when device already wedged\n\nigt@xe_wedged@wedged-at-any-timeout wedges the device in mode 2\n(UPON_ANY_HANG_NO_RESET) and then rebinds the driver. During unbind,\na GSC proxy kernel submission can still time out; with the device wedged\nand the GuC CT stopped it can never complete, so its kernel job times out.\n\n  Tile0: GT1: Kernel-submitted job timed out\n  WARNING: drivers/gpu/drm/xe/xe_guc_submit.c:...\n\t   at guc_exec_queue_timedout_job()\n  Workqueue: gt-ordered-wq drm_sched_job_timedout\n\nKilled queues skip guc_submit_hint_wedged(), leaving 'wedged' false even\nthough the device is already wedged. The timeout handler then treats the\nkernel queue timeout as unexpected and taints the kernel.\n\nHonour an already-wedged device even for killed queues so the expected\nteardown timeout no longer trips the WARN.\n\n(cherry picked from commit a1c1dbd0f047bb05de6aaf6abe9103031179bf19)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/xe/xe_guc_submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5a2f117a80c207372513ca8964eeb178874f4990","lessThan":"041cce629a08d4a2f1a28ec61a105b26b7f047e6","versionType":"git","status":"affected"},{"version":"5a2f117a80c207372513ca8964eeb178874f4990","lessThan":"24d81b72992006f9c390f1fc85c7f991e6d06fd6","versionType":"git","status":"affected"},{"version":"5a2f117a80c207372513ca8964eeb178874f4990","lessThan":"13087ad7817e6e5f210064518bfc4d6d58a9c2f3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/xe/xe_guc_submit.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/041cce629a08d4a2f1a28ec61a105b26b7f047e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/13087ad7817e6e5f210064518bfc4d6d58a9c2f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24d81b72992006f9c390f1fc85c7f991e6d06fd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93249","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.070","lastModified":"2026-10-19T10:17:16.123","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: amlogic-spisg: Make sure clk_init_data is fully initialized\n\nThe clk_init_data structure contains several mutually-exclusive members\nfor different methods to specify the possible parents of a clock,\nprompting drivers to initialize only the members they need.  However,\nnot initializing all members may cause subtle issues, which are only\nexposed when CONFIG_INIT_STACK_ALL_PATTERN or CONFIG_INIT_STACK_NONE is\nenabled.\n\naml_spisg_clk_init() fills in init.parent_data, and assumes that\ninit.parent_names is NULL.  However, the latter in uninitialized, and\nthus may cause a crash.\n\nMake sure all members are fully initialized, to fix such bugs, and to\navoid future breakage when converting drivers to a different method for\nspecifying the parents."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi-amlogic-spisg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cef9991e04aed3305c61c392e880f6e01a0c2ea4","lessThan":"bfce0f324efaa605e606cbb3f0bdb8fe5c910c11","versionType":"git","status":"affected"},{"version":"cef9991e04aed3305c61c392e880f6e01a0c2ea4","lessThan":"5969a3df8361a0e20379a308c2313d3e263123de","versionType":"git","status":"affected"},{"version":"cef9991e04aed3305c61c392e880f6e01a0c2ea4","lessThan":"b2702908ee23ef31bfcf241a2e07ace0eb76bd71","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi-amlogic-spisg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5969a3df8361a0e20379a308c2313d3e263123de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2702908ee23ef31bfcf241a2e07ace0eb76bd71","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfce0f324efaa605e606cbb3f0bdb8fe5c910c11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93250","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.187","lastModified":"2026-10-19T10:17:16.213","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvxlan: mdb: Fix use-after-free in vxlan_mdb_flush()\n\nvxlan_mdb_flush() iterates over the MDB entries using\nhlist_for_each_entry_safe(), which only tolerates the removal of the\ncurrent entry. Contrary to the comment above the loop, the removal of an\nentry can trigger the removal of another entry.\n\nFlushing the remotes of a (*, G) entry also removes the (S, G) entries\nthat were created for its source list, once they are left without\nremotes:\n\nvxlan_mdb_remotes_flush()\n-> vxlan_mdb_remote_del()\n   -> vxlan_mdb_remote_srcs_del()\n      -> vxlan_mdb_remote_src_del()\n         -> vxlan_mdb_remote_src_fwd_del()\n            -> __vxlan_mdb_del()\n               -> vxlan_mdb_entry_put()\n\nSuch an entry can be located after the (*, G) entry in the list, as\nvxlan_mdb_entry_get() returns an existing entry without moving it to the\nhead of the list. This order is obtained by adding the (S, G) entry\nbefore the (*, G) entry, the latter with NLM_F_REPLACE, as the addition\nof the source otherwise fails with -EEXIST. The (S, G) entry is then the\nentry saved by hlist_for_each_entry_safe() and it is freed while the\n(*, G) entry is processed. The next iteration calls hlist_del() on it\nagain, writing LIST_POISON1 to LIST_POISON2 [1].\n\nBesides device deletion, the flush is also reachable from RTM_DELMDB\nwith NLM_F_BULK.\n\nFix by re-reading the next entry after the remotes were flushed. The\ncurrent entry cannot be removed by this flush, as source lists can only\nbe configured on (*, G) entries and the removed entries are (S, G)\nentries. It is therefore still linked and its next pointer reflects the\nremovals.\n\n[1]\nBUG: KASAN: wild-memory-access in vxlan_mdb_entry_put.part.0+0x328/0x588\nWrite of size 8 at addr dead000000000122 by task ip/327\n\nCPU: 3 UID: 1000 PID: 327 Comm: ip Not tainted 7.2.0-rc7 #2 PREEMPT\nCall trace:\n vxlan_mdb_entry_put.part.0+0x328/0x588\n vxlan_mdb_flush+0x1d8/0x25c\n vxlan_mdb_fini+0x8c/0x100\n vxlan_uninit+0x1c/0x7c\n unregister_netdevice_many_notify+0x954/0xd4c\n rtnl_dellink+0x210/0x530\n rtnetlink_rcv_msg+0x434/0x4d0\n netlink_rcv_skb+0xc4/0x204\n rtnetlink_rcv+0x18/0x24\n netlink_unicast+0x4b8/0x548\n netlink_sendmsg+0x29c/0x560\n ____sys_sendmsg+0x390/0x3ec\n ___sys_sendmsg+0x114/0x188\n __sys_sendmsg+0xf0/0x178\n __arm64_sys_sendmsg+0x48/0x60\n invoke_syscall.constprop.0+0x58/0x180\n el0_svc_common.constprop.0+0x74/0x140\n do_el0_svc+0x30/0x40\n el0_svc+0x38/0x98\n el0t_64_sync_handler+0xa0/0xe4\n el0t_64_sync+0x198/0x19c"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/vxlan/vxlan_mdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"f8a9b988e7a7bc674e74e8c901794d792c35689e","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"c7dc26d06f90ca11bbd6114f6a62a67d038816c7","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"3e6b705bc162fc7257645725a7d2cf6c71250318","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"f26400b325bdc2868e40612c4804c82cf8ba6275","versionType":"git","status":"affected"},{"version":"a3a48de5eade770e911d35291217bdd69ce04ef1","lessThan":"bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/vxlan/vxlan_mdb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3e6b705bc162fc7257645725a7d2cf6c71250318","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc2dc66a6693a78f8c1e6ca2dbebd50f16e2c366","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7dc26d06f90ca11bbd6114f6a62a67d038816c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f26400b325bdc2868e40612c4804c82cf8ba6275","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8a9b988e7a7bc674e74e8c901794d792c35689e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93251","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.340","lastModified":"2026-10-21T13:21:06.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPI: bus: Introduce acpi_bus_get_primary_device()\n\nThe function used for obtaining the first \"physical\" device for which\nthe given ACPI one is the ACPI companion, acpi_get_first_physical_node(),\nmay return a stale device pointer (mostly in theory) because\nacpi_unbind_one() may run as a whole after dropping the ACPI device's\nphysical_node_lock in acpi_get_first_physical_node() and before it\nreturns.  The last reference to the \"physical\" device may be dropped\nthen before the pointer to it is returned to the caller.\n\nIf that happens and the acpi_get_first_physical_node() caller invokes\nget_device() on the pointer obtained from it, which is done by the\nmajority of its callers, a use-after-free will occur.\n\nTo prepare for addressing this problem, introduce a new function for\ngetting the first \"physical\" device associated with the given ACPI one\n(the \"primary physical device\") that will also reference count the\ndevice in question before returning a pointer to it.\n\nMake that new function and acpi_get_first_physical_node() share the\nphysical node list lookup code.\n\nNo intentional functional impact."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/bus.c","include/acpi/acpi_bus.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"50ddd82b88b1d1cc467b5df953344c1a9feec268","versionType":"git","status":"affected"},{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"fd4f907b558721716da30acd6630191acf811b95","versionType":"git","status":"affected"},{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"ebdd932dc24c1cf7cc31710b7730515e4e66d886","versionType":"git","status":"affected"},{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"5657859851abb65105220a6cdb5804926249f714","versionType":"git","status":"affected"},{"version":"91e5687805885f9fceb60b95e950a3d3bdcf4764","lessThan":"72530e1f72b0515a73fd88292254d04fecf03649","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/bus.c","include/acpi/acpi_bus.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.8","status":"affected"},{"version":"0","lessThan":"3.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/50ddd82b88b1d1cc467b5df953344c1a9feec268","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5657859851abb65105220a6cdb5804926249f714","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72530e1f72b0515a73fd88292254d04fecf03649","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebdd932dc24c1cf7cc31710b7730515e4e66d886","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd4f907b558721716da30acd6630191acf811b95","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93252","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.463","lastModified":"2026-10-19T10:17:16.453","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix circular locking dependency in ocfs2_init_acl()\n\nA lockdep warning indicates a circular locking dependency between\n`&oi->ip_xattr_sem` and `&journal->j_trans_barrier`:\n\nWARNING: possible circular locking dependency detected\nis trying to acquire lock:\n (&oi->ip_xattr_sem){++++}-{4:4}, at: ocfs2_init_acl+0x2fd/0x7e0\n fs/ocfs2/acl.c:367\n\nbut task is already holding lock:\n (&journal->j_trans_barrier){.+.+}-{4:4}, at: ocfs2_start_trans+0x3ab/0x700\n fs/ocfs2/journal.c:369\n\nThe deadlock involves two code paths: Path 1 (setxattr) where\n`ocfs2_xattr_set()` acquires `ip_xattr_sem` (write) and then starts a\ntransaction, which acquires `j_trans_barrier` (read); and Path 2\n(mkdir/mknod) where `ocfs2_mknod()` starts a transaction (`j_trans_barrier`\nread) and then calls `ocfs2_init_acl()`, which attempts to acquire\n`ip_xattr_sem` (read) on the parent directory to retrieve the default ACL.\n\nBecause rw_semaphores are subject to writer priority, a pending writer on\n`j_trans_barrier` (e.g., the journal commit thread) can cause Path 1 to\nblock, while Path 2 is blocked waiting for Path 1 to release\n`ip_xattr_sem`.\n\nThe patch fixes the lock ordering by precomputing the ACL state before\nstarting the OCFS2 transaction, while preserving POSIX ACL storage\nsemantics and the existing inode/security initialization order. By reading\nthe parent directory's default ACL and preparing the new inode's ACLs\noutside the transaction, `ip_xattr_sem` is always acquired before\n`j_trans_barrier`.\n\n`struct ocfs2_acl_state` encapsulates the prepared ACL state, while\n`ocfs2_acl_init_prepare()` and `ocfs2_acl_init_release()` avoid code\nduplication between `ocfs2_mknod()` and `ocfs2_init_security_and_acl()`.\n`ocfs2_calc_xattr_init()` and `ocfs2_init_acl()` use this precomputed\nstate, removing internal `ip_xattr_sem` acquisition and redundant disk\nreads.\n\nAdditionally, remove the `ip_xattr_sem` acquisition from\n`ocfs2_xattr_set_handle()`. This function is only used while initializing a\nnew inode that has not yet been inserted into the inode hash or attached to\na dentry, meaning there is no risk of concurrent access and the lock is\nunnecessary."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ocfs2/acl.c","fs/ocfs2/acl.h","fs/ocfs2/namei.c","fs/ocfs2/xattr.c","fs/ocfs2/xattr.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"4936d4464d1ae10b5fbba64374085a0dcc060560","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"caf3056936fb8b5ce92e419cf8b246ce9c437343","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"5b7b3c50c39ad0dc27e7418981e01c4183273f89","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"8d88f52fbbbcc18adf4091a955511d0cf605bf11","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"8931403ee3dcfe8a24a5267efec9d9460ab7a1b5","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"1222f7a3183b35c0c566899fdaead5c7c4043076","versionType":"git","status":"affected"},{"version":"16c8d569f5704a84164f30ff01b29879f3438065","lessThan":"bd7c05fb4a4776dff5a87b19008d28458647d15d","versionType":"git","status":"affected"},{"version":"15ac59a84750b3afc0a2b6f2636c4f7e6cbd6d5e","versionType":"git","status":"affected"},{"version":"b35bb8a41795caa05e09c3aacf7d78f1f20bac04","versionType":"git","status":"affected"},{"version":"1d5fdc1307eeb04b334c5dc23e11dbd6068d90eb","versionType":"git","status":"affected"},{"version":"a66174eb4a149b7919d174d9a7ce6ad9909c5ee2","versionType":"git","status":"affected"},{"version":"3.18.111","lessThan":"3.19","versionType":"semver","status":"affected"},{"version":"4.4.134","lessThan":"4.5","versionType":"semver","status":"affected"},{"version":"4.9.104","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.37","lessThan":"4.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ocfs2/acl.c","fs/ocfs2/acl.h","fs/ocfs2/namei.c","fs/ocfs2/xattr.c","fs/ocfs2/xattr.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1222f7a3183b35c0c566899fdaead5c7c4043076","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4936d4464d1ae10b5fbba64374085a0dcc060560","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b7b3c50c39ad0dc27e7418981e01c4183273f89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8931403ee3dcfe8a24a5267efec9d9460ab7a1b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d88f52fbbbcc18adf4091a955511d0cf605bf11","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd7c05fb4a4776dff5a87b19008d28458647d15d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/caf3056936fb8b5ce92e419cf8b246ce9c437343","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8747d81aa6d3efe3ee339a9d912ff3ca6e4d758","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93253","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.640","lastModified":"2026-10-19T10:17:16.593","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsched/isolation: Defer freeing of cpumask memblock memory to initcall\n\nWhen testing a linux-next kernel with commit 59bd1d914bb5 (\"memblock:\nwarn when freeing reserved memory before memory map is initialized\"),\nthe following warning was hit when there was a \"nohz_full\" kernel boot\nparameter.\n\n  Cannot free reserved memory because of deferred initialization of the memory map\n  WARNING: mm/memblock.c:904 at __free_reserved_area+0xde/0xf0, CPU#0: swapper/0/0\n    :\n  Call Trace:\n   <TASK>\n   memblock_phys_free+0xcb/0x100\n   housekeeping_init+0x14c/0x170\n   start_kernel+0x207/0x450\n   x86_64_start_reservations+0x24/0x30\n   x86_64_start_kernel+0xda/0xe0\n   common_startup_64+0x13e/0x141\n   </TASK>\n\nIOW, we shouldn't free memblock allocated memory so early\nin the boot process when memory map isn't fully initialized in\ndeferred_init_memmap().\n\nFix it by saving the housekeeping cpumask memblock memory to be\nfreed into a llist free list in housekeeping_init() and add a new\nhousekeeping_late_init() helper to defer the actual freeing of memblock\nmemory to when initcall's are being processed. The cpumask memblock\nmemory is treated as a llist_node with the size of a \"long\" type which\nis also smallest cpumask size that can be allocated.\n\nThe non-atomic version of the llist APIs are used as there is no\ncontention.\n\nThis commit depends on the presence of commit 7c2eee9c1367 (\"memblock:\ndon't touch memblock arrays when memblock_free() is called late\")\nto prevent a KASAN UAF bug report [1].\n\n [1] https://lore.kernel.org/lkml/20260505051821.1107133-1-longman@redhat.com/"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/sched/isolation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"27c3a5967f054ab666704cb28f2aeb18ca07cab7","lessThan":"811fdac2d1bdf0b0d3fda262aac288ddd13a1422","versionType":"git","status":"affected"},{"version":"27c3a5967f054ab666704cb28f2aeb18ca07cab7","lessThan":"2b58c749b8c5244e259a0230bc57b10b010dc545","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/sched/isolation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2b58c749b8c5244e259a0230bc57b10b010dc545","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/811fdac2d1bdf0b0d3fda262aac288ddd13a1422","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93254","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:21.807","lastModified":"2026-10-19T10:17:16.687","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: entry: Avoid unnecessary local_irq_disable() on kernel exit\n\nCurrently, when exiting to kernel mode, we attempt involuntary\npreemption. The preemption logic expects IRQs to be disabled, which is\nwhy we call local_irq_disable() before attempting preemption.\n\nHowever, depending on the context, local_irq_disable() may be\nunnecessary:\n\n- __el1_irq(), the non-NMI EL1 IRQ path, already has IRQs disabled, so\n  local_irq_disable() is redundant.\n\n- irqentry_exit_to_kernel_mode_preempt() immediately returns when\n  exiting from an NMI-like context, so calling local_irq_disable()\n  beforehand is unnecessary work.\n\nFurthermore, it confuses the pNMI state tracking when we are in a\ncontext with interrupts disabled and the GIC_PRIO_PSR_I_SET bit is set\nin the PMR, leading to a warning when\nCONFIG_ARM64_DEBUG_PRIORITY_MASKING=y:\n\n     WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64_exit_to_kernel_mode+0xb8/0xc0, CPU#40: retsnoop/31805\n     CPU: 40 UID: 0 PID: 31805 Comm: retsnoop Not tainted 7.2.0-rc6-next-20260805 #7 PREEMPTLAZY\n     pstate: 234013c9 (nzCv DAIF +PAN -UAO +TCO +DIT +SSBS BTYPE=--)\n     pc : arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63)\n     lr : el1_abort (arch/arm64/kernel/entry-common.c:323)\n     pmr: 000000f0\n     Call trace:\n      arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63) (P)\n      el1_abort (arch/arm64/kernel/entry-common.c:323)\n      el1h_64_sync_handler (arch/arm64/kernel/entry-common.c:449)\n      el1h_64_sync (arch/arm64/kernel/entry.S:589)\n      [...]\n\nSplit arm64_exit_to_kernel_mode() into preempt, non-preempt, and\ndispatch parts so that we can avoid this extra work where it is not\nneeded and avoid breaking the pNMI tracking logic."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/kernel/entry-common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ae654112eac05f316ef31587fc55e4d7160d0086","lessThan":"49a61174186bed25d439ff37400c7ce5e3603e73","versionType":"git","status":"affected"},{"version":"ae654112eac05f316ef31587fc55e4d7160d0086","lessThan":"39aebe0e89469c2904e60b1e977e0d4dbf33326b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/kernel/entry-common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/39aebe0e89469c2904e60b1e977e0d4dbf33326b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/49a61174186bed25d439ff37400c7ce5e3603e73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93255","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.007","lastModified":"2026-10-19T10:17:16.780","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock\n\n[FALSE ALERTS]\nThere is a bug report that the warning inside\ninvalidate_and_check_btree_folios() got triggered during btrfs/298:\n\n BTRFS info (device sdd): first mount of filesystem f9bf732a-a19b-44b9-99a7-614ddff168e2\n BTRFS info (device sdd): using crc32c checksum algorithm\n BTRFS error (device sdd): failed to find fsid cb2fdb42-b638-4f2f-badd-4127467ba674 when attempting to open seed devices\n BTRFS error (device sdd): failed to read chunk tree: -2\n ------------[ cut here ]------------\n WARNING: disk-io.c:3342 at invalidate_and_check_btree_folios+0x260/0x3c0 [btrfs], CPU#4: mount/125993\n CPU: 4 UID: 0 PID: 125993 Comm: mount Tainted: G        W  OE       7.1.0-rc7-custom+ #1 PREEMPT(full)\n Hardware name: QEMU KVM Virtual Machine, BIOS edk2-20250812-19.fc42 08/12/2025\n Call trace:\n  invalidate_and_check_btree_folios+0x260/0x3c0 [btrfs] (P)\n  open_ctree+0x1f50/0x23b0 [btrfs]\n  btrfs_get_tree+0x89c/0xc48 [btrfs]\n  vfs_get_tree+0x30/0x110\n  vfs_cmd_create+0x58/0xe8\n  __arm64_sys_fsconfig+0x39c/0x518\n  invoke_syscall.constprop.0+0x48/0x120\n  el0_svc_common.constprop.0+0x40/0xe8\n  do_el0_svc+0x24/0x38\n  el0_svc+0x50/0x310\n  el0t_64_sync_handler+0xa0/0xe8\n  el0t_64_sync+0x198/0x1a0\n ---[ end trace 0000000000000000 ]---\n BTRFS warning (device sdd): unable to release extent buffer 365985792 owner 3 gen 17 refs 3 flags 0x5\n\n[CAUSE]\nIn that invalidate_and_check_btree_folios() we wait for the eb to finish\nits read, then check if it's only held by us and the btree inode.\n\nIf not, then do a warning as it may be still held, and could cause\nproblems.\n\nBut there is a small window where the check can lead to false alerts:\n\n    Thread A (Read endio)         |        Thread B (Unmount)\n----------------------------------+-------------------------------------\n end_bbio_meta_read()             |\n | The eb has one extra ref held  |\n | by the reader, and has         |\n | EXTENT_BUFFER_READING flag set | invalidate_and_check_btree_folios()\n |                                | |\n |- clear_extent_buffer_reading() | |\n |                                | |- wait_on_bit_io();\n |                                | |  The EXTENT_BUFFER_READING flag is\n |                                | |  cleared\n |                                | |- if (refcount_read(eb->refs) > 2)\n |                                |    The eb is held by the read, us\n |                                |    and btree inode, thus it\n |                                |    will trigger the warning\n |- free_extent_buffer()          |\n\n[FIX]\nIntroduce a helper, free_extent_buffer_clear_reading().\n\nIf the new parameter, @clear_reading, is set, we will hold the spinlock\nat the beginning of free_extent_buffer_clear_reading() to make sure the\nEXTENT_BUFFER_READING flag is cleared inside the same critical section\nof decreasing refs.\n\nNow free_extent_buffer() will just call\nfree_extent_buffer_clear_reading() with @clear_reading set to false, so\nno behavior change.\n\nBut for end_bbio_meta_read(), it will not clear_extent_buffer_reading()\ndirectly, but pass @clear_reading as true.\n\nThen inside invalidate_and_check_btree_folios(), hold the refs_lock\nbefore reading refs.\nSo that we eliminate the race window completely."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/disk-io.c","fs/btrfs/extent_io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f5427cab065641a4553d38bb8c4932b8d456c7a7","lessThan":"8f7285d608ed0db7c9f09f341547db5ce1351090","versionType":"git","status":"affected"},{"version":"83f7e52b7ed1c3e03b79123e20b6f6adf8d886bb","lessThan":"2073f3d97b0c5d34fe64812d1237e37bd79c17ec","versionType":"git","status":"affected"},{"version":"83f7e52b7ed1c3e03b79123e20b6f6adf8d886bb","lessThan":"690c2accacb1aca91ab8186d15dee56da8723f31","versionType":"git","status":"affected"},{"version":"b0c33c0628c5b0678fcae2e05e7b2764149248f8","versionType":"git","status":"affected"},{"version":"7.1.8","lessThan":"7.2","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/disk-io.c","fs/btrfs/extent_io.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.2","status":"affected"},{"version":"0","lessThan":"7.2","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2073f3d97b0c5d34fe64812d1237e37bd79c17ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/690c2accacb1aca91ab8186d15dee56da8723f31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f7285d608ed0db7c9f09f341547db5ce1351090","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93256","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.157","lastModified":"2026-10-19T10:17:16.893","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: hibernate: mask DAIF before restoring hibernated kernel\n\nThe arm64 hibernate code manages the exception masking in an unsound\nway, leading to potential crashes and/or warnings during resume.\n\nWhen a hibernation image is saved in `swsusp_arch_suspend()`, all DAIF\nexceptions are masked (by virtue of `local_daif_save()`), and the\nsuspended image is saved assuming that all DAIF exceptions will remain\nmasked when the image is restored.\n\nWhen a hibernation image is resumed by `swsusp_arch_resume()`, only\ninterrupts are masked (by virtue of `local_irq_disable()` in\n`resume_target_kernel()`). When pseudo-NMI is enabled the DAIF.IF bits\nwill be clear, and regardless of pseudo-NMI the DAIF.DA bits will be\nclear.\n\nThis means that there are two problems:\n\n(1) It is possible to take Debug, SError, or pseudo-NMI exceptions\n    during the resume process. This is unsafe, as during the resume\n    process both the old ane new kernels will tranisently be in an\n    inconsistent state, and swsusp_arch_suspend_exit() won't retain\n    an executable mapping of any exception vectors.\n\n    Any exception taken here will be fatal and silent.\n\n(2) When re-entering the resumed kernel, some DAIF bits will be clear\n    unexpectedly. This permits Debug, SError, or pseudo-NMI exceptions\n    to be taken for a short period while the resumed kernel is not yet\n    in a consistent state.\n\n    This is detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING.\n\nAvoid these issues by masking all DAIF exceptions during resume."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/kernel/hibernate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"c9c671e9ab87b639720db8f7f8648bdf0f3bc8ec","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"099ad3edcef1d955d9f5d6aab16ae78ecdfd4cda","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"716c41bd476334afb943308be9ff2142e34461b7","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"5370853041a3cb53a125b77528586278f64b378b","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"290c5b0c9fc0c61fb1c41421ed2394f955206ea0","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"012823494e20c3cce622982ebd3fd6971be39ad2","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"d736ace2c491623c9ab5e73744085e93e9ae3ebe","versionType":"git","status":"affected"},{"version":"82869ac57b5d3b550446932c918dbf2caf020c9e","lessThan":"684bde100117931f4c51c644a95f42f2dab041bc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/kernel/hibernate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/012823494e20c3cce622982ebd3fd6971be39ad2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/099ad3edcef1d955d9f5d6aab16ae78ecdfd4cda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/290c5b0c9fc0c61fb1c41421ed2394f955206ea0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5370853041a3cb53a125b77528586278f64b378b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/684bde100117931f4c51c644a95f42f2dab041bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/716c41bd476334afb943308be9ff2142e34461b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9c671e9ab87b639720db8f7f8648bdf0f3bc8ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d736ace2c491623c9ab5e73744085e93e9ae3ebe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93257","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.310","lastModified":"2026-10-19T10:17:17.020","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: handle nogenerate/noverify properly in fs-integrity\n\nCheck the BIP_CHECK flags before generating or verifying PI information,\notherwise this can be incorrectly called for non-PI metadata and\ncause generation of incorrect metadata and crashed in the verification\nhandler.\n\nThe new behavior matches that of the block layer auto-generated\nmetadata."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["block/bio-integrity-fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0bde8a12b5540572a7fd6d2867bee6de15e4f289","lessThan":"b681c740e6d645f7d7477e9208db57917c6c0fbc","versionType":"git","status":"affected"},{"version":"0bde8a12b5540572a7fd6d2867bee6de15e4f289","lessThan":"3bf9a21e7bccfd8c35b440efd114c61cc9838a41","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["block/bio-integrity-fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3bf9a21e7bccfd8c35b440efd114c61cc9838a41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b681c740e6d645f7d7477e9208db57917c6c0fbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93258","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.420","lastModified":"2026-10-19T10:17:17.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()\n\nThis reverts commit 58b6fcd2ab34 (\"ocfs2: mark inode bad upon validation\nfailure during read\").\n\nSince 'make_bad_inode()' resets inode type to S_IFREG, doing this for\ndirectory inode during active VFS lookup is likely to confuse the latter,\nincluding VFS_BUG_ON_INODE() triggered in this case."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"58b6fcd2ab34399258dc509f701d0986a8e0bcaa","lessThan":"0e7459abff46e28e64367057038ef8607e63f599","versionType":"git","status":"affected"},{"version":"58b6fcd2ab34399258dc509f701d0986a8e0bcaa","lessThan":"d48ace65322001b41bb5322442a21425ef4407d4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ocfs2/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0e7459abff46e28e64367057038ef8607e63f599","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d48ace65322001b41bb5322442a21425ef4407d4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93259","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.530","lastModified":"2026-10-19T10:17:17.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/irq: Fix missing r2 clobber in PCREL inline assembly\n\nIn CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC\npointer and is available as a caller-saved register [0].\n\nBoth call_do_irq() and call_do_softirq() use inline assembly to call\nfunctions with stack switching, but fail to list r2 in their clobber\nlists. This causes the compiler to assume r2 is preserved across these\ncalls, leading to register corruption when the called functions\n(__do_irq and __do_softirq) clobber r2.\n\nAs a result of this kernel crash during interrupt handling is seen and\nthe kernel fails to boot:\n\nBUG: Unable to handle kernel data access on write at 0xc000000404697638\nFaulting instruction address: 0xc0000000000181ec\nOops: Kernel access of bad area, sig: 11 [#1]\nNIP [c0000000000181ec] __do_IRQ+0x6c/0xc0\n\nWith older GCC, the compiler would conservatively allocate\ncallee-saved registers (like r31) for values spanning function calls,\naccidentally avoiding the bug:\n\n<__do_IRQ>:\n00 00 00 60 \tnop\na6 02 08 7c \tmflr    r0\nf8 ff e1 fb \tstd     r31,-8(r1)\nf0 ff c1 fb \tstd     r30,-16(r1)\n2d 03 10 06 \tpla     r31,53297316\n\n...\n\n3d e8 ff 4b \tbl      c0000000000165ac <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 4d e9 \tld      r10,40(r13)\n40 00 21 38 \taddi    r1,r1,64\n2a f9 aa 7f \tstdx    r29,r10,r31\n\nWith newer GCC 14, the compiler uses r2 for such values, exposing the\nmissing clobber specification:\n\n<__do_IRQ>:\n00 00 00 60     nop\na6 02 08 7c     mflr    r0\nf0 ff c1 fb     std     r30,-16(r1)\nf8 ff e1 fb     std     r31,-8(r1)\n29 02 10 06     pla     r2,36252592     # c0000000022aadc0 <__irq_regs>\n\n...\n\n85 dc ff 4b \tbl      c000000000015ee0 <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 2d e9 \tld      r9,40(r13)\n30 00 21 38 \taddi    r1,r1,48\n2a 11 c9 7f \tstdx    r30,r9,r2\n\nFix this by adding r2 to the clobber list for both call_do_irq() and\ncall_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.\n\n[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/powerpc/kernel/irq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"dcc442a49c0f540193910dacdca7506bcadc7ec5","versionType":"git","status":"affected"},{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a","versionType":"git","status":"affected"},{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"90d953002cf0b233dd053a0e7cb67ab79cebd0e3","versionType":"git","status":"affected"},{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"7b0093b638c8f2b94b0778a69fd1ccad54299b29","versionType":"git","status":"affected"},{"version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","lessThan":"00be69070d91d2be978e752bb117a0a4db0e1281","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/powerpc/kernel/irq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/00be69070d91d2be978e752bb117a0a4db0e1281","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7b0093b638c8f2b94b0778a69fd1ccad54299b29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90d953002cf0b233dd053a0e7cb67ab79cebd0e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dcc442a49c0f540193910dacdca7506bcadc7ec5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93260","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.670","lastModified":"2026-10-21T13:21:07.093","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: propagate IPI init errors to prevent use-after-free\n\nWhen xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),\nthe error path frees the global xive_ipis array.  However,\nxive_smp_probe() previously ignored this failure and proceeded to\ncall xive_setup_cpu_ipi(), which dereferences the already-freed\nxive_ipis pointer -- a use-after-free.\n\nNow that xive_smp_probe() returns int (previous patch), propagate\nthe error from xive_init_ipis() and xive_setup_cpu_ipi() through\nxive_smp_probe().  Check the return value in both pnv_smp_probe()\nand pSeries_smp_probe() so that IPI setup is aborted cleanly on\nfailure, avoiding the use-after-free."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"e36b1c2eafcaaddefa70d55e6fda74cf6cda38af","versionType":"git","status":"affected"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"2ea6238343691309e68308131c7e80c3ae05afea","versionType":"git","status":"affected"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"5c9ab0c9cede9f149733d330e2d7d45341b71359","versionType":"git","status":"affected"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"c554a8d376d5aea1b237ed6bef6f9fbfc550e67f","versionType":"git","status":"affected"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"411a3c016e7a95f5fa105a0587e07d0647a77727","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2ea6238343691309e68308131c7e80c3ae05afea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e36b1c2eafcaaddefa70d55e6fda74cf6cda38af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93261","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.780","lastModified":"2026-10-19T10:17:17.410","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nlocking/lockdep: Fix NULL pointer dereference in __lock_set_class()\n\nregister_lock_class() can return NULL when the lock class pool is\nexhausted, graph_lock() fails, or key validation fails. However,\n__lock_set_class() uses the return value directly in pointer arithmetic\nwithout a NULL check:\n\n  class = register_lock_class(lock, subclass, 0);\n  hlock->class_idx = class - lock_classes;\n\nIf class is NULL, this computes a wild offset that corrupts\nhlock->class_idx. The subsequent reacquire_held_locks() call will\ninvoke hlock_class() with this corrupted index, leading to a NULL or\nout-of-bounds pointer dereference.\n\nAdd the missing NULL check, consistent with how __lock_acquire() already\nhandles this case at the same call site."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/locking/lockdep.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"f6093ff67ea6e347574819ed23e96e0f82a25ffc","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"f56e54fd24f05e9de528fcb77f6084f80c8066ce","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"5c3bff6cf26e6a54fbf8b893a879c32824d2d50d","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"b2113dcd8238bf00ce37a34e67b29cf31d32a545","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"e7c69c6695d84220847cca62a45e879e71e79e9d","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"9be10f49dfc2e4b472b3a5f346483b67374774b8","versionType":"git","status":"affected"},{"version":"64aa348edc617dea17bbd01ddee4e47886d5ec8c","lessThan":"7577e00b9ab506202b9f1a33de3cc8cc6413a4db","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/locking/lockdep.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.27","status":"affected"},{"version":"0","lessThan":"2.6.27","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/59a5c7dd331a3dab48100e1ef8e9bb4f9132a2b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5c3bff6cf26e6a54fbf8b893a879c32824d2d50d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7577e00b9ab506202b9f1a33de3cc8cc6413a4db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9be10f49dfc2e4b472b3a5f346483b67374774b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2113dcd8238bf00ce37a34e67b29cf31d32a545","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7c69c6695d84220847cca62a45e879e71e79e9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f56e54fd24f05e9de528fcb77f6084f80c8066ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6093ff67ea6e347574819ed23e96e0f82a25ffc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93262","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:22.927","lastModified":"2026-10-19T10:17:17.523","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmd/raid5-ppl: fix use-after-free in ppl_do_flush()\n\nThe loop in ppl_do_flush() continues iterating after calling\nppl_io_unit_finished(), touching io->pending_flushes and leading to a\nuse-after-free.\n\nAdd a break statement to stop the loop once io is freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/md/raid5-ppl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"cf01f9413565e86673baf927291a088b6975692b","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"e7505842f1329ece90cb9ea0db87772aeca44052","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"b5123bf667ac29ddd8106f9ca7cc01316513ae66","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"e77c80670f2c2bf491da9b173931e1da4677c23a","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"8914c3d40870f16429a326e97e4016bedc6ede4c","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"455b56209f9615c3902dcc398dd867abb5ade3ab","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"fcf21df7d3c50c8ebeb0757df5d21b02dcae4218","versionType":"git","status":"affected"},{"version":"1532d9e87e8b2377f12929f9e40724d5fbe6ecc5","lessThan":"371f7a1b392edc8b7cf449cc7713179b588f2d0e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/md/raid5-ppl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/371f7a1b392edc8b7cf449cc7713179b588f2d0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/455b56209f9615c3902dcc398dd867abb5ade3ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8914c3d40870f16429a326e97e4016bedc6ede4c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b5123bf667ac29ddd8106f9ca7cc01316513ae66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf01f9413565e86673baf927291a088b6975692b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7505842f1329ece90cb9ea0db87772aeca44052","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e77c80670f2c2bf491da9b173931e1da4677c23a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fcf21df7d3c50c8ebeb0757df5d21b02dcae4218","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93263","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.067","lastModified":"2026-10-19T10:17:17.657","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nclk: eswin: Zero-initialize stack-allocated clk_init_data\n\neswin_clk_register_pll() and eswin_register_clkdiv() declare a struct\nclk_init_data on the stack and only initialize some of its fields\n(parent_data respectively parent_hws). clk_core_populate_parent_map()\nchecks parent_names first and parent_data second before falling back\nto parent_hws, so leftover stack garbage in the uninitialized fields\nhijacks parent resolution and the clk core dereferences a bogus\npointer:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 000000000000000c\n  Oops [#1]\n  epc : __clk_register+0x31a/0x7f0\n  [<ffffffff805dc774>] __clk_register+0x31a/0x7f0\n  [<ffffffff805dcd76>] devm_clk_hw_register+0x2a/0x94\n  [<ffffffff805e319a>] eswin_register_clkdiv+0x80/0xd0\n  [<ffffffff805e34a0>] eswin_clk_register_clks+0x162/0x1a0\n  [<ffffffff805e3736>] eic7700_clk_probe+0x146/0x180\n  [<ffffffff8065d23c>] platform_probe+0x3c/0x7a\n\nObserved on EIC7700 hardware (with the driver backported to a 6.17\ntree); whether the bug triggers depends entirely on what the stack\nhappens to contain when the registration helpers run.\n\nZero-initialize both structures."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/clk/eswin/clk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cd44f127c1d42833a32ba0a0965255ee6184f8c1","lessThan":"1183dc2450a268a536a15da8b106ec520cdbd19f","versionType":"git","status":"affected"},{"version":"cd44f127c1d42833a32ba0a0965255ee6184f8c1","lessThan":"011d8de504bc84402aabc1dda1cf0552fe9a5af2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/clk/eswin/clk.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/011d8de504bc84402aabc1dda1cf0552fe9a5af2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1183dc2450a268a536a15da8b106ec520cdbd19f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93264","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.193","lastModified":"2026-10-19T10:17:17.760","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/efa: Fix PBL chunk length computation\n\nOn register MR, when creating the PBL, if it's an indirect PBL we create\na chunk list to hold the PBL pages pointers. Each chunk is 4KB in size\nand can hold 510 addresses (EFA_PTRS_PER_CHUNK) and has a 12-byte\ncontrol buffer at the end of it holding the next chunk's pointer and its\nlength.\n\nIf the PBL number of pages is a multiple of EFA_PTRS_PER_CHUNK, the\ncalculated last chunk length is wrongly computed as 0, even though that\nchunk is fully populated with 510 real page pointers. This wrong length\nis used both to DMA map the chunk and is propagated to the device,\ncausing the device to see the chunk as empty and reject the memory\nregistration.\n\nFix the calculation so it will be performed only if the number of pages\nisn't a multiple of EFA_PTRS_PER_CHUNK, if it is, its already handled in\nthe above loop correctly.\nAlso prevent out-of-bounds reach in the chunks array in such scenario."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/efa/efa_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"665cd418b8561a099c3854443f8ad8ae751b72a0","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"932e5684906a090644a9061fae2d254041c3b8f2","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"489b28f2377afa70c18c45b06a6387f3d39bb123","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"aadf3f9b5edb7f0a77e9172b237d2e07c754829c","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"3982714e15512b83115897806dacc94899683420","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"da7805f0211af19968584e621074f253ac07dba7","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"1d4b5902773475fc97151379b7e5f09cad0fa57b","versionType":"git","status":"affected"},{"version":"40909f664d279765af430acc5db348a0b71c9b0a","lessThan":"229b42d7450c1cf96f45ec39ebb69211b06bc036","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/hw/efa/efa_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1d4b5902773475fc97151379b7e5f09cad0fa57b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/229b42d7450c1cf96f45ec39ebb69211b06bc036","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3982714e15512b83115897806dacc94899683420","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/489b28f2377afa70c18c45b06a6387f3d39bb123","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/665cd418b8561a099c3854443f8ad8ae751b72a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/932e5684906a090644a9061fae2d254041c3b8f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aadf3f9b5edb7f0a77e9172b237d2e07c754829c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da7805f0211af19968584e621074f253ac07dba7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93265","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.340","lastModified":"2026-10-19T10:17:17.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node\n\nDSP3 has an integrated Ethernet MAC Endpoint which has its own set of\nconfig registers for configuring settings such as ASPM. The Endpoint device\nhas two physical functions and those two functions share the same settings.\n\nParse the Endpoint node under DSP3 instead of parsing both functions.  The\nexisting parsing logic also has one OOB issue as parsing both functions\nwill result in accessing past the tc9563_pwrctrl->cfg array."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/pwrctrl/pci-pwrctrl-tc9563.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4c9c7be47310c1dbd7b6d37d45986123f5b133b4","lessThan":"972c771674e88a43c8310c459ea30f0f0d0c168f","versionType":"git","status":"affected"},{"version":"4c9c7be47310c1dbd7b6d37d45986123f5b133b4","lessThan":"6e5e6c2194b2acbded5b12ed80590d215b786d29","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/pwrctrl/pci-pwrctrl-tc9563.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.19","status":"affected"},{"version":"0","lessThan":"6.19","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/6e5e6c2194b2acbded5b12ed80590d215b786d29","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/972c771674e88a43c8310c459ea30f0f0d0c168f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93266","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.453","lastModified":"2026-10-19T10:17:18.003","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: RSI: fix field-spanning write warning in attestation token init\n\nThe challenge is passed in registers a1 through a8. However, copying to\n&regs.a1 makes FORTIFY treat the destination as the single a1 field,\nresulting in a field-spanning write warning. [1]\n\nOverlay the SMCCC register structure with an RSI-specific argument\nlayout and copy the challenge into an explicit 64-byte array. This keeps\nthe existing a1-a8 argument encoding while giving the copy a correctly\nsized destination object.\n\n[1]\nmemcpy: detected field-spanning write (size 64) of single field \"&regs.a1\" at ./arch/arm64/include/asm/rsi_cmds.h:119 (size 8)\nWARNING: ./arch/arm64/include/asm/rsi_cmds.h:119 at rsi_attestation_token_init+0xdc/0xf8 [arm_cca_guest], CPU#0: cat/3314"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/arm64/include/asm/rsi_cmds.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b880a80011f56880f32bde47fc6af313359f926b","lessThan":"e505092cb200d430d5b8d8d3e926d45f29474ba3","versionType":"git","status":"affected"},{"version":"b880a80011f56880f32bde47fc6af313359f926b","lessThan":"d29a8ee271da17b5e32d7a76a9c78d43f66447ca","versionType":"git","status":"affected"},{"version":"b880a80011f56880f32bde47fc6af313359f926b","lessThan":"221049874b6a78c7d87bc826581b0695cd338e2b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/arm64/include/asm/rsi_cmds.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/221049874b6a78c7d87bc826581b0695cd338e2b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d29a8ee271da17b5e32d7a76a9c78d43f66447ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e505092cb200d430d5b8d8d3e926d45f29474ba3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93267","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.570","lastModified":"2026-10-19T10:17:18.093","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Fix potential use after free in uverbs_free_dmah()\n\nWhen accessing a dmah via the netlink path the only synchronization\nmechanism for the said dmah is rdma_restrack_get().\nCurrently, rdma_restrack_del() is invoked at the end of\nuverbs_free_dmah(), which is too late, since by that point\nvendor-specific resources associated with the dmah might already be\nfreed. This can leave a short window where the dmah remains accessible\nthrough restrack, leading to a potential use-after-free.\n\nFix this by moving the rdma_restrack_begin_del() call to the start of\nuverbs_free_dmah(), ensuring that the dmah is removed from restrack\nbefore its internal resources are released. This guarantees that no new\nusers hold references to a dmah that is in the process of destruction.\n\nIn addition, this change preserves the intended inverted order\nbetween create and destroy routines: resources are added to\nrestrack at the end of successful creation, and hence shall be removed\nfrom the restrack first thing during the destruction flow, which keeps\nthe lifecycle management consistent and predictable."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/uverbs_std_types_dmah.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d83edab562a496a42720902a1d2effccd05c37c5","lessThan":"8b22722f45a29a7c0900b1d4d0bc5da5492ece10","versionType":"git","status":"affected"},{"version":"d83edab562a496a42720902a1d2effccd05c37c5","lessThan":"bfc119a40c04bbe3daad826f2160ccbfae6c64ce","versionType":"git","status":"affected"},{"version":"d83edab562a496a42720902a1d2effccd05c37c5","lessThan":"2696626a0be5877f445fb647c25ef43930c777e6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/uverbs_std_types_dmah.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2696626a0be5877f445fb647c25ef43930c777e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b22722f45a29a7c0900b1d4d0bc5da5492ece10","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfc119a40c04bbe3daad826f2160ccbfae6c64ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93268","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.730","lastModified":"2026-10-19T10:17:18.230","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: skip extra isize expansion during mount to prevent deadlock\n\next4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty()\nwhile holding an active jbd2 handle.  During mount (!SB_ACTIVE), the\nexpand path may move xattrs to external blocks and release ea_inodes via\niput().  When !SB_ACTIVE, iput() calls write_inode_now() which acquires\ns_writepages_rwsem, creating a circular lock dependency:\n\n  s_writepages_rwsem --> jbd2_handle --> xattr_sem --> s_writepages_rwsem\n\nThis can be triggered via:\n\n  ext4_process_orphan() -> ext4_truncate() -> ext4_mark_inode_dirty()\n    -> ext4_try_to_expand_extra_isize()\n\nor:\n\n  ext4_evict_inode() -> ext4_mark_inode_dirty()\n    -> ext4_try_to_expand_extra_isize()\n\nSkip expansion when !SB_ACTIVE.  This is a minor loss of functionality\n(extra isize won't grow for these inodes during mount), which e2fsck\ncan resolve later if needed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"41897f1bcf4ace5f1f28d0be784b6f4f0e929641","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"9c3469377b1d8caba6bec6ef3c460810bbfb02cc","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"1dd4882dbdc8bfdf2182fa388883c143fac0902a","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"7ba09330d9ea6e996228316719eae812d7e04983","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"c5e6434cc55f30220b228be237bb666351f9f4dd","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"7ace189b9ea79cf78df9c32b940ce12735f9459a","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"2fb8ff81659a57c42bb7b49e8339a2be2a318ef8","versionType":"git","status":"affected"},{"version":"c8585c6fcaf2011de54c3592e80a634a2b9e1a7f","lessThan":"7461c60b9c6a839b13ad4c3490681a0cf5aa0637","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ext4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1dd4882dbdc8bfdf2182fa388883c143fac0902a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2fb8ff81659a57c42bb7b49e8339a2be2a318ef8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41897f1bcf4ace5f1f28d0be784b6f4f0e929641","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7461c60b9c6a839b13ad4c3490681a0cf5aa0637","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ace189b9ea79cf78df9c32b940ce12735f9459a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ba09330d9ea6e996228316719eae812d7e04983","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c3469377b1d8caba6bec6ef3c460810bbfb02cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5e6434cc55f30220b228be237bb666351f9f4dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93269","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:23.873","lastModified":"2026-10-19T10:17:18.350","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix circular lock dependency in ext4_ext_migrate\n\nMove iput(tmp_inode) after ext4_writepages_up_write() to avoid a\ncircular lock dependency between s_writepages_rwsem and sb_internal\n(freeze protection).\n\nThe deadlock scenario:\n\n  CPU0 (EXT4_IOC_MIGRATE)        CPU1 (orphan cleanup during mount)\n  ----                           ----\n  ext4_ext_migrate()\n    ext4_writepages_down_write()\n      s_writepages_rwsem (write)\n                                 ext4_evict_inode()\n                                   sb_start_intwrite()   [sb_internal]\n                                   ...\n                                     ext4_writepages()\n                                       s_writepages_rwsem (read) [BLOCKED]\n    iput(tmp_inode)\n      ext4_evict_inode()\n        sb_start_intwrite()         [BLOCKED]\n\nThe tmp_inode is a temporary inode with nlink=0 created solely for\nbuilding the extent tree.  Its eviction does not require\ns_writepages_rwsem protection, so deferring iput() until after\nreleasing the rwsem is safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ext4/migrate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"452950461241dfed8b1d32e94b227db38c99c5af","versionType":"git","status":"affected"},{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"ada23457d4748d6e9c36c6f871fc29a6f558c48c","versionType":"git","status":"affected"},{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"e4223231b6860141813637a6413c2371ae4d6fa8","versionType":"git","status":"affected"},{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"32f7ab52875ec7f800ca67e7176e5743a84baddf","versionType":"git","status":"affected"},{"version":"cb85f4d23f794e24127f3e562cb3b54b0803f456","lessThan":"a897682793eba5de51ee6f3152760374afa629cf","versionType":"git","status":"affected"},{"version":"eb799e163dc2bc1ea0a4820b66f79d32a5e907df","versionType":"git","status":"affected"},{"version":"bcc1eab71a67c46b9e24544ac7923f44444174ce","versionType":"git","status":"affected"},{"version":"8cf20fb73e73a4c4df0328b5297842c5ef34fdd9","versionType":"git","status":"affected"},{"version":"e5d25003d059649e18a249635ed5ca7a7b1de5ad","versionType":"git","status":"affected"},{"version":"69f8a7991fd93c49096ddd11574db3e7df238b7b","versionType":"git","status":"affected"},{"version":"4.9.215","lessThan":"4.10","versionType":"semver","status":"affected"},{"version":"4.14.172","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.107","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.4.23","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.5.7","lessThan":"5.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ext4/migrate.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/32f7ab52875ec7f800ca67e7176e5743a84baddf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/452950461241dfed8b1d32e94b227db38c99c5af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a897682793eba5de51ee6f3152760374afa629cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ada23457d4748d6e9c36c6f871fc29a6f558c48c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4223231b6860141813637a6413c2371ae4d6fa8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93270","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.020","lastModified":"2026-10-19T10:17:18.460","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn\n\nThe BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for\n'dst_reg = src_reg + <percpu_base_off>'.\n\nHowever, the interpreter ignores the 'off' at its ALU64_MOV_X label.\nThe 'off' indicates the insn is BPF_MOV64_PERCPU_REG insn. Then, when\nthe interpreter loads memory from the register, it will hit a page\nfault.\n\n[    2.545572] BUG: unable to handle page fault for address: ffffffffacaaf034\n[    2.546485] #PF: supervisor read access in kernel mode\n[    2.547167] #PF: error_code(0x0000) - not-present page\n[    2.547850] PGD 134e63067 P4D 134e63067 PUD 134e64063 PMD 10021c063 PTE 800ffffeca550062\n[    2.548912] Oops: Oops: 0000 [#1] SMP PTI\n\nSet jit_required as true in order to disallow interpreter fallback in\ncore.c::__bpf_prog_select_runtime(), if any BPF_ADDR_PERCPU insn is\npatched to the prog.\n\nBTW, rename the helper bpf_map_supports_cpu_flags() to\nbpf_map_is_percpu_map()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["include/linux/bpf.h","kernel/bpf/fixups.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7bdbf7446305cb65c510c16d57cde82bc76b234a","lessThan":"57cf929a33cb76be3f24886073ae820b4c496914","versionType":"git","status":"affected"},{"version":"7bdbf7446305cb65c510c16d57cde82bc76b234a","lessThan":"7a0855e73757ee9cf25ba635a1c735018ecba742","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["include/linux/bpf.h","kernel/bpf/fixups.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/57cf929a33cb76be3f24886073ae820b4c496914","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a0855e73757ee9cf25ba635a1c735018ecba742","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93271","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.133","lastModified":"2026-10-19T10:17:18.557","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate\n\nath11k can receive HT/VHT/HE frames whose reported MCS is above the\nmaximum that can be expressed in the corresponding mac80211 rate space\n(e.g. an HE frame reported with MCS 12, while HE tops out at MCS 11).\n\nThe frame itself is valid and decodes correctly, but for such a frame\nath11k_dp_rx_h_rate() leaves rx_status->rate_idx set to the out-of-range\nvalue and never assigns rx_status->encoding, so it stays RX_ENC_LEGACY\nfrom the ath11k_dp_rx_h_ppdu() initialization. Once that frame reaches\nmac80211 it trips the rate sanity check and the frame is dropped with a\nsplat:\n\n  ath11k_pci 0000:03:00.0: Received with invalid mcs in HE mode 12\n  WARNING: CPU: 0 PID: 0 at net/mac80211/rx.c:5433 ieee80211_rx_list+0xb0a/0xe90 [mac80211]\n\nDropping the frame would discard otherwise valid data, so instead cap the\nreported MCS to the maximum the rate space can express and deliver the\nframe. Set rx_status->encoding before the range check and assign rate_idx\nfrom the capped value, so a frame with an out-of-range MCS no longer\nleaves partial or bogus rate metadata behind. Also downgrade the logging\nlevel since they are not treated as invalid frames now. The only loss is\nthat such a frame is reported as the capped MCS in the rx rate statistics.\n\nTested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"6ad04c3e2ec54bf5ec72c81afdd66318a116c539","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"a6b951f79e66fc8bd93a537ff1040fbfb567c8bf","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"b77bfe6e59b98dff3ccfcf9b45fc27e3db498626","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"fb7b9a7209f839c17c66484dfdc84c9a23c6fd2f","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"a0b3e6f9645d88f387c4fea546048a91952cd4cd","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"2bb2a778a487305bd378db5fd5014fbdce4ada2c","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"ccbd20f2168f581d90265da1a925b9b6472a0b05","versionType":"git","status":"affected"},{"version":"d5c65159f2895379e11ca13f62feabe93278985d","lessThan":"12b09e478aa7459b7893a695ef77682202f2da83","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12b09e478aa7459b7893a695ef77682202f2da83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2bb2a778a487305bd378db5fd5014fbdce4ada2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ad04c3e2ec54bf5ec72c81afdd66318a116c539","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0b3e6f9645d88f387c4fea546048a91952cd4cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6b951f79e66fc8bd93a537ff1040fbfb567c8bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b77bfe6e59b98dff3ccfcf9b45fc27e3db498626","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ccbd20f2168f581d90265da1a925b9b6472a0b05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb7b9a7209f839c17c66484dfdc84c9a23c6fd2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93272","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.280","lastModified":"2026-10-21T13:21:07.297","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nremoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3\n\nThe changes introduced to handle single power domain platforms have\nswapped the info pointer increment from num_pd_vregs to num_pds, which\nwould shift the info pointer past the end of the array for pronto-v3,\nwhich does not list power domain regulators in vregs.\n\nThis showed up as a difference between GCC- and LLVM-compiled kernels\non SDM632 devices, where only with LLVM one would get the\n\"regulator request with no identifier\" error, because the out-of-bounds\nmemory ended up being zeroed. Fix by skipping the increment when there\nare more power domains than regulators."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/remoteproc/qcom_wcnss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fef1e1487dea81c2b4560e393ba4b0be57e28d01","lessThan":"7abab59d6c99ba2b8101d6f44ad25159b1510724","versionType":"git","status":"affected"},{"version":"69bb5b3ae348040e385113efba5bdc76396644d0","lessThan":"e572cbb513cde53d90fb4729cad75056cd647ce3","versionType":"git","status":"affected"},{"version":"65991ea8a6d1e68effdc01d95ebe39f1653f7b71","lessThan":"2e7e39bb81913feaac463b7add46bafdca06fbde","versionType":"git","status":"affected"},{"version":"65991ea8a6d1e68effdc01d95ebe39f1653f7b71","lessThan":"bce6b48af3abf7468d12ef4933f21bd8c1d822e9","versionType":"git","status":"affected"},{"version":"65991ea8a6d1e68effdc01d95ebe39f1653f7b71","lessThan":"3dbc90b9c22ea96e37bf55f6011e63b5123ec668","versionType":"git","status":"affected"},{"version":"654c295f9079d2c7875172142022168e34c4e34e","versionType":"git","status":"affected"},{"version":"8d0d4c11cace475f1b07f98ee3d2bd334590e17b","versionType":"git","status":"affected"},{"version":"04a89c98810d2dba8187120c07fdb732aa40ca14","versionType":"git","status":"affected"},{"version":"6.6.93","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.31","lessThan":"6.12.114","versionType":"semver","status":"affected"},{"version":"5.15.185","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.141","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.14.9","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/remoteproc/qcom_wcnss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2e7e39bb81913feaac463b7add46bafdca06fbde","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3dbc90b9c22ea96e37bf55f6011e63b5123ec668","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7abab59d6c99ba2b8101d6f44ad25159b1510724","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bce6b48af3abf7468d12ef4933f21bd8c1d822e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e572cbb513cde53d90fb4729cad75056cd647ce3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93273","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.400","lastModified":"2026-10-19T10:17:18.793","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nregulator: tps6594: Fix device node reference leaks in multiphase loop\n\nIn tps6594_regulator_probe(), the multi-phase configuration loop calls\nof_find_node_by_name() to find buck nodes by name, and of_get_parent()\ntwice to navigate to the PMIC parent node. None of the acquired node\nreferences (np, intermediate parent, np_pmic_parent) are ever released\nvia of_node_put(), causing a reference leak on every loop iteration.\n\nAdditionally, of_find_node_by_name() can return NULL, but the result was\nimmediately passed to of_node_full_name() and of_get_parent() without a\nNULL check, which could lead to a NULL pointer dereference.\n\nFix this by:\n- Adding a NULL check for np after of_find_node_by_name()\n- Storing the intermediate parent node in a local variable np_parent\n- Calling of_node_put() on np, np_parent and np_pmic_parent at the\n  end of each loop iteration"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/regulator/tps6594-regulator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"28f70e0aa767a8f022c70ed75ecef227dc668121","versionType":"git","status":"affected"},{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"4a672bff99f6b58dde419fd12b3a53da137f032d","versionType":"git","status":"affected"},{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"68ce4f8223b78f8616ec7f4a02c38988eae627d2","versionType":"git","status":"affected"},{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"fceac25487b21d6db940d2aed368e465d89cd1f4","versionType":"git","status":"affected"},{"version":"f17ccc5deb4d024bb52fd3433471e77ab7ae9ad8","lessThan":"7fd28093b3effc4f92566466df364622830ec608","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/regulator/tps6594-regulator.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/28f70e0aa767a8f022c70ed75ecef227dc668121","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a672bff99f6b58dde419fd12b3a53da137f032d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68ce4f8223b78f8616ec7f4a02c38988eae627d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7fd28093b3effc4f92566466df364622830ec608","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fceac25487b21d6db940d2aed368e465d89cd1f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93274","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.527","lastModified":"2026-10-19T10:17:18.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: bcm2835: Don't remove an unregistered GPIO chip\n\nIf the devm_pinctrl_register() function fails,\nbcm2835_pinctrl_probe() calls gpiochip_remove()\nbefore gpiochip_add_data() has registered the GPIO chip.\n\nThis means that upon failure the gpio_chip.gpiodev\n is NULL resulting in a null pointer dereference\ninside the gpiochip_remove() function.\n\nRemove the unnecessary function call to gpiochip_remove().\nNo GPIO cleanup is required because the GPIO chip\nhas not yet been registered. Without this change there\nis potential for a kernel panic upon registration failure"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pinctrl/bcm/pinctrl-bcm2835.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ba696b470839d70c6b8290c1f798bac7fb2a584c","lessThan":"d428863ca8baa4e9eaf781266ac219b017dcf277","versionType":"git","status":"affected"},{"version":"79c6d4fa1be1fd0819c50ebb4dee101bbbc4d20e","lessThan":"f494cfc254cd509d7cbc44b843e0a6602a520a33","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"dd6b1919e41d1260259c4505777be565fb3a7efd","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"3b978fd0a3092b25561ac26bc1a87149fa981ddc","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"b8535f5c77cc61352d02a0c038a280127a8b8208","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"68ea6dd23b732081826c36033835468383487864","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"727f043d699ab0d5d87122c2177f2b45fbe58d35","versionType":"git","status":"affected"},{"version":"266423e60ea1b953fcc0cd97f3dad85857e434d1","lessThan":"32711f77db0641e57fd96fdc013bf1286b9f2514","versionType":"git","status":"affected"},{"version":"75278f1aff5e14c904d3503c6f836c42a7afb441","versionType":"git","status":"affected"},{"version":"5.10.89","lessThan":"5.10.270","versionType":"semver","status":"affected"},{"version":"5.15.12","lessThan":"5.15.221","versionType":"semver","status":"affected"},{"version":"5.4.175","lessThan":"5.5","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pinctrl/bcm/pinctrl-bcm2835.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/32711f77db0641e57fd96fdc013bf1286b9f2514","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b978fd0a3092b25561ac26bc1a87149fa981ddc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68ea6dd23b732081826c36033835468383487864","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/727f043d699ab0d5d87122c2177f2b45fbe58d35","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8535f5c77cc61352d02a0c038a280127a8b8208","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d428863ca8baa4e9eaf781266ac219b017dcf277","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd6b1919e41d1260259c4505777be565fb3a7efd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f494cfc254cd509d7cbc44b843e0a6602a520a33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93275","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.667","lastModified":"2026-10-19T10:17:19.020","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/pt: Fix stop/start with no update\n\nIf pt_event_stop() is called without PERF_EF_UPDATE flag, then\nperf_aux_output_end() is not called.  A subsequent call to pt_event_start()\nwill call perf_aux_output_begin() again which violates the rule against\nnesting and triggers a WARNING in perf_aux_output_begin().\n\nOriginally, pt_event_stop() was never called without PERF_EF_UPDATE,\nbecause the only code paths to do so are from event overflow, and Intel PT\ndoes not do that.\n\nHowever the introduction of group throttling by commit 9734e25fbf5ae\n(\"perf: Fix the throttle logic for a group\") meant that an Intel PT event\ncould be throttled if it was part of a group.  Throttling calls PMU\n ->stop() / ->start() callbacks without flags.\n\nAn example is when AUX area sampling is used. The following commands\nhit the issue:\n\n  echo 10000 > /proc/sys/kernel/perf_event_max_sample_rate\n\n  perf record -F32000 --aux-sample -e '{intel_pt//u,cycles:u}' \\\n  -- bash -c 'for i in `seq 1 100000` ; do true ; done'\n\nUse PERF_HES_UPTODATE to track whether perf_aux_output_begin() and\nperf_aux_output_end() are balanced.  A cleared PERF_HES_UPTODATE bit\nindicates that an AUX output context is still open.\n\nAmend pt_event_start() / pt_event_stop() accordingly so that begin/end\nstay balanced:\n\n - In non-snapshot mode, stop() always closes the buffer (the buffer may\n   have run out of space, and that accounting is done by the update), so\n   a following start() opens a fresh one as before.\n\n - In snapshot/overwrite mode, stop() without PERF_EF_UPDATE leaves the\n   buffer open so that pt_event_snapshot_aux() can still copy from it,\n   and start() then only re-enables tracing instead of calling\n   perf_aux_output_begin() again.\n\nNote that pt_event_del() calls pt_event_stop() with PERF_EF_UPDATE flag set\n(as is required by the documentation), so a final call to\nperf_aux_output_end() is assured."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["arch/x86/events/intel/pt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9734e25fbf5ae68eb04234b2cd14a4b36ab89141","lessThan":"cab5015ee3f25f789b4a368f2abfa65536576b78","versionType":"git","status":"affected"},{"version":"9734e25fbf5ae68eb04234b2cd14a4b36ab89141","lessThan":"304844b5545f444d523286da8228a1cbc46ffffa","versionType":"git","status":"affected"},{"version":"9734e25fbf5ae68eb04234b2cd14a4b36ab89141","lessThan":"2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["arch/x86/events/intel/pt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/304844b5545f444d523286da8228a1cbc46ffffa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cab5015ee3f25f789b4a368f2abfa65536576b78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93276","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.797","lastModified":"2026-10-19T10:17:19.130","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nphy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator\n\ndevm_regulator_get_exclusive() initialises the regulator with\nenable_count = 1, requiring the consumer to disable it before release.\n\nThe devm disable action was previously only registered when the caller\nexplicitly requested enable, so when the regulator was left in its initial\nenabled state without an explicit enable call, the cleanup path skipped\ndecrementing enable_count, triggering a WARN_ON during regulator\nrelease on device removal.\n\nFix this by always registering the devm disable action based on the actual\nenabled state via regulator_is_enabled(), regardless of whether the\ncaller requested an explicit enable. This covers both the explicitly\nenabled case and the initial state set by devm_regulator_get_exclusive()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/phy/renesas/phy-rcar-gen3-usb2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"24843404efe47eab1ee88d7475a0be0f2f6fd9db","lessThan":"bf7fefbc26e292c08cfe7b6496b879109ef1475a","versionType":"git","status":"affected"},{"version":"24843404efe47eab1ee88d7475a0be0f2f6fd9db","lessThan":"935f6e837a83b86b073a7601f699dc2c00e01322","versionType":"git","status":"affected"},{"version":"24843404efe47eab1ee88d7475a0be0f2f6fd9db","lessThan":"49c9b71b45081e5e5eeb507a2d6edb80d332dc59","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/phy/renesas/phy-rcar-gen3-usb2.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/49c9b71b45081e5e5eeb507a2d6edb80d332dc59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/935f6e837a83b86b073a7601f699dc2c00e01322","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bf7fefbc26e292c08cfe7b6496b879109ef1475a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93277","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:24.907","lastModified":"2026-10-19T10:17:19.223","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/bnxt_re: Validate udata before executing commands\n\nThe destroy callbacks currently zero the udata output after tearing down\ndriver resources. If the userspace access fails, uverbs preserves the\nuobject and allows the destroy callback to run again, even though the\ndriver resource has already been freed.\n\nCall ib_no_udata_io() before teardown so udata failures are detected\nwhile the resource is still intact, then return success after teardown\ncompletes.\n\nAs part of this change, move ib_respond_empty_udata() to the start of\nthe create and modify flows. While this is not strictly required for\ngeneral create flows, as the core layer unwinds uobjects on failure, it\nis necessary for create AH. In _rdma_create_ah(), the HW object is\notherwise leaked."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bed686d8dcd4fbcaa18cf67468caaf8772acfc7a","lessThan":"c5643ea4f040acc2f4d1e88f49bd0be51110ff2f","versionType":"git","status":"affected"},{"version":"bed686d8dcd4fbcaa18cf67468caaf8772acfc7a","lessThan":"d38c835925d4a3bfdf0a85ff2829ee90c709c561","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/hw/bnxt_re/ib_verbs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/c5643ea4f040acc2f4d1e88f49bd0be51110ff2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d38c835925d4a3bfdf0a85ff2829ee90c709c561","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93278","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.017","lastModified":"2026-10-19T10:17:19.330","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: octeon: add missing napi_disable in cvm_oct_rx_shutdown\n\ncvm_oct_rx_shutdown calls free_irq and netif_napi_del without\ndisabling the napi instance first. As the free_irq only waits\nfor completion of hard interrupt handlers, the napi poll\nfunction could still be active. If cvm_oct_remove proceeds to\nfree the plat structure (which holds the NAPI instances), the\nactive poll function will access freed memory, resulting in a\nuse-after-free crash."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/octeon/ethernet-rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"158389d7af04bbf0664d91c2ce31fcc9eeace1eb","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"c124049c3a7006fd6caf629139a5722610bbffb4","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"98f9036b2254c928cb44da0c77dba38f66f7d8f1","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"b38fbd68cc36b4f478a1e3cfc169b8616ae1337d","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"89f9f433271fad9351de6a3c713b45b2cfb23e4a","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"b2243ffaac14cc3639b5b32a371aac37f96ee554","versionType":"git","status":"affected"},{"version":"3368c784bcf77124aaf39372e627016c36bd4472","lessThan":"c0a9a8586a63fda49e61a6b83360feac2a60d898","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/octeon/ethernet-rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","lessThan":"2.6.34","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/158389d7af04bbf0664d91c2ce31fcc9eeace1eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/89f9f433271fad9351de6a3c713b45b2cfb23e4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98f9036b2254c928cb44da0c77dba38f66f7d8f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2243ffaac14cc3639b5b32a371aac37f96ee554","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b38fbd68cc36b4f478a1e3cfc169b8616ae1337d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0a9a8586a63fda49e61a6b83360feac2a60d898","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c124049c3a7006fd6caf629139a5722610bbffb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93279","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.147","lastModified":"2026-10-19T10:17:19.447","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown\n\nThe TX cleanup tasklet can be scheduled by the watchdog IRQ handler\nto execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in\nthe queue which might run after the cvm_oct_remove() frees net_device\nstructures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it\niterates cvm_oct_device[] which is an array of netdevice pointers.\nAdd tasklet_kill() after free_irq() to ensure the tasklet is no longer\nscheduled or running before teardown proceeds."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/octeon/ethernet-tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"d15226338dfaa84ffff142d32723cdf74d0c47c4","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"b6365e4186322858a82c8713b1d0bd209c8e765a","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"03d12490afd1198310ad0aba42462329832eb739","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"2c0c9956596e48654bb4855e2a0742748a0826a7","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"41a79bd9e5a74f8f483b3b206d10567912874fb4","versionType":"git","status":"affected"},{"version":"4898c560103fb8075c10a8e9d70e0ca26873075e","lessThan":"b9af44b0d20b2247c4eb0ea5cfca907d643eea50","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/octeon/ethernet-tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.34","status":"affected"},{"version":"0","lessThan":"2.6.34","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03d12490afd1198310ad0aba42462329832eb739","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c0c9956596e48654bb4855e2a0742748a0826a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/32efcb6d5f4e3f030e7b0a3ba5c6c0684dd07486","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41a79bd9e5a74f8f483b3b206d10567912874fb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a77efd85e0d48c877f66d2bc3ab89cc1b8dacd19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6365e4186322858a82c8713b1d0bd209c8e765a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b9af44b0d20b2247c4eb0ea5cfca907d643eea50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d15226338dfaa84ffff142d32723cdf74d0c47c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93280","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.290","lastModified":"2026-10-19T10:17:19.560","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngreybus: audio: bound the topology section sizes against the fetched size\n\ngb_audio_gb_get_topology() fetches a topology blob of a module-supplied\nsize, and gbaudio_tplg_parse_data() then walks it by adding the\nmodule-supplied size_dais, size_controls and size_widgets fields to\nform the control, widget and route section offsets. Those le32 sizes\nare never checked against the fetched blob, so a module reporting a\nsmall topology size but large section sizes makes the offsets point\npast the allocation, and parsing reads out of bounds.\n\nReject a topology whose section sizes do not fit within the fetched\nsize before it is parsed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/staging/greybus/audio_gb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"dd5593aee0a0fb353e1164aff7b65e563fe1f232","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"6f764363b3173d805be11e59a8f23ecee2d420d5","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"52daf9de692ebac813d110eb1e677dc0e1f4a5ab","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"d0f6eaba60705bacd9bb4ce48eab50ef3f546777","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"c9191f2e2f35f1209eb2dc24b31129dd47b48c16","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"cfcc5a41a9664eb68023aae4cd0d485b256bd7c7","versionType":"git","status":"affected"},{"version":"184992e305f1de3a3d5fa446da3a2bc76be7c54a","lessThan":"33d8c7b794d2a30637c9d3fcb478f1d3222bef1e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/staging/greybus/audio_gb.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/33d8c7b794d2a30637c9d3fcb478f1d3222bef1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52daf9de692ebac813d110eb1e677dc0e1f4a5ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f764363b3173d805be11e59a8f23ecee2d420d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9191f2e2f35f1209eb2dc24b31129dd47b48c16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfcc5a41a9664eb68023aae4cd0d485b256bd7c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0f6eaba60705bacd9bb4ce48eab50ef3f546777","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd5593aee0a0fb353e1164aff7b65e563fe1f232","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93281","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.440","lastModified":"2026-10-19T10:17:19.700","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: fix HE extended capability length check\n\nrtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability\nbyte 10, but rejects only datalen values below 10.  Byte 10 requires at\nleast 11 bytes.\n\nRequire datalen >= 11 before reading data[10]."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/realtek/rtw89/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"eddf53f1edb0cf7f302bd15cdb47cca90948c205","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"655c4401c18d735dbaf2cc172ff4f626b3a896a0","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"bddbd1de765bf6ddc0473ad683910eb3a2a92a43","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"f2a01deff7d0d5cc3dcbf2358dac113979303c8e","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"f132fc01b359a0f7d81fe13d769ea4e7c4baa66e","versionType":"git","status":"affected"},{"version":"8d540f9d29162e273797bef36686a010724f0f8a","lessThan":"2aba608a86e9b099c9af2ea70b620552dee2b628","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/realtek/rtw89/mac.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2aba608a86e9b099c9af2ea70b620552dee2b628","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/655c4401c18d735dbaf2cc172ff4f626b3a896a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bddbd1de765bf6ddc0473ad683910eb3a2a92a43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eddf53f1edb0cf7f302bd15cdb47cca90948c205","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f132fc01b359a0f7d81fe13d769ea4e7c4baa66e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2a01deff7d0d5cc3dcbf2358dac113979303c8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93282","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.570","lastModified":"2026-10-21T13:21:07.430","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix maximum allowed access checks\n\nThe DACL permission check looks for an ACE matching the current user and\nfalls back to the Everyone ACE. It does not consider an Authenticated\nUsers ACE, even though an authenticated session is a member of that\nwell-known group.\n\nAs a result, opening a file whose access is granted through S-1-5-11 can\nincorrectly fail with STATUS_ACCESS_DENIED. Treat an Authenticated Users\nACE as a fallback entry alongside Everyone.\n\nThe maximal access calculation also combines access masks from every ACE,\nregardless of whether its SID applies to the current user. This can grant\nrights belonging to an unrelated principal. Process only ACEs applying to\nthe user, Everyone, or Authenticated Users, and accumulate allowed and\ndenied masks in ACL order. Preserve explicitly requested access bits so\nthey are validated against the resulting maximal mask.\n\nWhen ACCESS_SYSTEM_SECURITY is denied, report STATUS_PRIVILEGE_NOT_HELD\ninstead of the generic STATUS_ACCESS_DENIED. Access to the system ACL\nrequires a security privilege that ksmbd does not grant.\n\nFor regular files, include FILE_EXECUTE in maximal access when the client\nrequested GENERIC_EXECUTE and the DACL grants the complete file-read set.\nKeep a direct FILE_EXECUTE request subject to the explicit DACL bit. This\nmatches the POSIX file ACL mapping without broadening specific execute\nrequests.\n\nDo not replace rights from an applicable NT ACE with a POSIX ACL entry.\nThe POSIX ACL is only a fallback when no user, Everyone, or Authenticated\nUsers ACE applies; otherwise it can incorrectly broaden the stored DACL.\n\nThis fixes smb2.maximum_allowed.maximum_allowed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/smbacl.c","fs/smb/server/smbacl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"7c293e83d86cfd38124f51b27882ad631818bf48","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"37459edb69c094553026ee48c2cc2acc657f9f43","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"28289d880e6d11ae7ac77b81af3312453febf939","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"35d5c59fe6b1d9fe43fb14eb384f69ee1a120f9c","versionType":"git","status":"affected"},{"version":"e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9","lessThan":"cc2f133e80eb2c4a04bfa77a2f207749fe2f516a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/smb2pdu.c","fs/smb/server/smbacl.c","fs/smb/server/smbacl.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/28289d880e6d11ae7ac77b81af3312453febf939","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/35d5c59fe6b1d9fe43fb14eb384f69ee1a120f9c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/37459edb69c094553026ee48c2cc2acc657f9f43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c293e83d86cfd38124f51b27882ad631818bf48","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc2f133e80eb2c4a04bfa77a2f207749fe2f516a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93283","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T16:17:25.690","lastModified":"2026-10-19T10:17:19.927","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: Fix device_register() error path\n\nWhen device_register() fails in i3c_master_register_new_i3c_devs(),\nput_device() is called to drop the reference taken by\ndevice_register().  That drops the last reference, so the device's\nrelease callback i3c_device_release() runs and frees the i3c_device.\n\nTwo problems follow from that:\n\ni3c_device_release() does WARN_ON(i3cdev->desc), so it warns because\ndesc->dev->desc still points back at the descriptor.  Clear it before\ncalling put_device().\n\nAfter put_device() frees the i3c_device, desc->dev is left pointing at\nfreed memory, so clear desc->dev as well.  That prevents, for example,\ni3c_master_unregister_i3c_devs() seeing desc->dev as non-NULL and\ndereferencing it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i3c/master.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1832ed55df45f4145335ad992fb83813cdc58b5d","lessThan":"5bf498623f8397d45f85f14cd631c5e5a565c2fb","versionType":"git","status":"affected"},{"version":"d48fe8d98171e0fffdeaa8b37ce0a6444bff819b","lessThan":"20a2b6df91fd782ef2ff551febef594d0b46a9a7","versionType":"git","status":"affected"},{"version":"174ae0a3b89e7804e4ea3d31bd83d6e43f39568c","lessThan":"a14dbdf471001dd0601b0c491184990c178a199c","versionType":"git","status":"affected"},{"version":"e49a51a96b531f1b4bcd8d358e645b6c74ef67e6","lessThan":"d22ad96f1a0c89e0ba66a2facc7430f0923919e3","versionType":"git","status":"affected"},{"version":"cab63f64887616e3c4e31cfd8103320be6ebc8d3","lessThan":"7f8e2c4f3704d9774bb26b49b1ad6a60ae57d4a0","versionType":"git","status":"affected"},{"version":"cab63f64887616e3c4e31cfd8103320be6ebc8d3","lessThan":"7ef12e1dd06e442eebf370f6e53c41bd056d0f22","versionType":"git","status":"affected"},{"version":"cab63f64887616e3c4e31cfd8103320be6ebc8d3","lessThan":"6ecf17bf5fe8da51a6e3fc9e03a76898fcc5c6cf","versionType":"git","status":"affected"},{"version":"cab63f64887616e3c4e31cfd8103320be6ebc8d3","lessThan":"74be657d98a8d684c0475f3cbd450ef2a30ffc73","versionType":"git","status":"affected"},{"version":"204beeb509d37669de34560e83bb8abffe7ee63a","versionType":"git","status":"affected"},{"version":"b24cf43d9babf1265a2bb0ae8d198267cef43b83","versionType":"git","status":"affected"},{"version":"5.10.201","lessThan":"5.10.270","versionType":"semver","status":"affected"},{"version":"5.15.139","lessThan":"5.15.221","versionType":"semver","status":"affected"},{"version":"6.1.63","lessThan":"6.1.188","versionType":"semver","status":"affected"},{"version":"6.6.2","lessThan":"6.6.157","versionType":"semver","status":"affected"},{"version":"5.4.261","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"6.5.12","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i3c/master.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"5.10.270","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.221","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.188","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.157","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.110","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.52","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20a2b6df91fd782ef2ff551febef594d0b46a9a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bf498623f8397d45f85f14cd631c5e5a565c2fb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ecf17bf5fe8da51a6e3fc9e03a76898fcc5c6cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74be657d98a8d684c0475f3cbd450ef2a30ffc73","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ef12e1dd06e442eebf370f6e53c41bd056d0f22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f8e2c4f3704d9774bb26b49b1ad6a60ae57d4a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a14dbdf471001dd0601b0c491184990c178a199c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d22ad96f1a0c89e0ba66a2facc7430f0923919e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93425","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T16:17:25.990","lastModified":"2026-09-24T18:19:07.280","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from apps/dokploy/server/api/routers/patch.ts into a shell command in packages/server/src/services/patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. The supplied service identifier is used only to resolve the server and does not constrain repoPath. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Dokploy","product":"dokploy","versions":[{"version":"< 0.29.13","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:17:31.094265Z","id":"CVE-2026-93425","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/Dokploy/dokploy/commit/16b5b7293f9883327a89c69fcb6e5718767b064a","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/releases/tag/v0.29.13","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p","source":"security-advisories@github.com"},{"url":"https://github.com/Dokploy/dokploy/security/advisories/GHSA-56g6-wjr4-5q7p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-93541","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T16:17:26.163","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a"}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"X.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:19:51.914504Z","id":"CVE-2026-93541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=7b6fffd13fd3914e0b39f3a4f131913da7f066e7","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-96744","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T16:17:27.120","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Laravel MongoDB (PHP)","defaultStatus":"unaffected","versions":[{"version":"4.3.0","lessThan":"5.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:07:07.976230Z","id":"CVE-2026-96744","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/mongodb/laravel-mongodb/pull/3579","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/laravel-mongodb/releases/tag/5.11.0","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96745","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T16:17:27.293","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Deserialization of untrusted data in the command monitoring support of the MongoDB PHP Driver can cause class names embedded in document content to be honored when the driver builds monitoring event objects. When an application registers a command monitoring subscriber and includes untrusted data in a database operation, an unauthenticated party who controls that data may cause an application class implementing the driver's persistable interface to be instantiated and its unserialization method invoked with the supplied data. The resulting impact depends on the classes available in the application."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"PHP Driver","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.21.10","versionType":"semver","status":"affected"},{"version":"2.0.0","lessThan":"2.1.10","versionType":"semver","status":"affected"},{"version":"2.2.0","lessThan":"2.5.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:21:29.694907Z","id":"CVE-2026-96745","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/mongodb/mongo-php-driver/pull/2115","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/1.21.10","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/2.1.10","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/releases/tag/2.5.3","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-php-driver/security/advisories/GHSA-cmvj-vxvq-rh2c","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96746","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T16:17:27.460","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"C Driver","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.30.12","versionType":"semver","status":"affected"},{"version":"2.0.0","lessThan":"2.5.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:10:23.359575Z","id":"CVE-2026-96746","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/mongodb/mongo-c-driver/releases/tag/1.30.12","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-c-driver/releases/tag/2.5.5","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-c-driver/security/advisories/GHSA-frjf-h5jg-4v46","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96750","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T16:17:27.610","lastModified":"2026-09-25T04:17:50.150","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Compass","defaultStatus":"unaffected","versions":[{"version":"1.44.0","lessThan":"1.49.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-96750","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/mongodb-js/compass/releases/tag/v1.49.12","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96873","sourceIdentifier":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","published":"2026-09-24T16:17:28.040","lastModified":"2026-09-24T20:02:50.260","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS.\n\nThis issue affects Mediawiki - CirrusSearch extension through 1.46.0."}],"affected":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","affectedData":[{"vendor":"The Wikimedia Foundation","product":"Mediawiki - CirrusSearch Extension","defaultStatus":"unaffected","repo":"https://gerrit.wikimedia.org/g/mediawiki/extensions/CirrusSearch","versions":[{"version":"0","lessThanOrEqual":"1.46.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T15:37:53.640849Z","id":"CVE-2026-96873","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CirrusSearch/+/1344368","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"},{"url":"https://phabricator.wikimedia.org/T435234","source":"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}]}},{"cve":{"id":"CVE-2026-97225","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T16:17:28.880","lastModified":"2026-09-25T15:17:57.237","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in DbGate up to 7.2.5-beta.5. This affects an unknown function of the file packages/api/src/controllers/runners.js of the component JSON Runner. Executing a manipulation of the argument comment.text/script.schedule can lead to code injection. The attack may be performed from remote. Upgrading to version 7.2.5-beta.6 mitigates this issue. This patch is called 70e7b6b58e464d7a015ba16e8d7574b420ee4877. Upgrading the affected component is advised. This issue is distinct from CVE-2026-47668."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"DbGate","cpes":["cpe:2.3:a:dbgate:dbgate:*:*:*:*:*:*:*:*"],"modules":["JSON Runner"],"versions":[{"version":"7.2.5-beta.0","status":"affected"},{"version":"7.2.5-beta.1","status":"affected"},{"version":"7.2.5-beta.2","status":"affected"},{"version":"7.2.5-beta.3","status":"affected"},{"version":"7.2.5-beta.4","status":"affected"},{"version":"7.2.5-beta.5","status":"affected"},{"version":"7.2.5-beta.6","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:20:48.991603Z","id":"CVE-2026-97225","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/dbgate/dbgate/","source":"cna@vuldb.com"},{"url":"https://github.com/dbgate/dbgate/commit/70e7b6b58e464d7a015ba16e8d7574b420ee4877","source":"cna@vuldb.com"},{"url":"https://github.com/dbgate/dbgate/pull/1527","source":"cna@vuldb.com"},{"url":"https://github.com/dbgate/dbgate/releases/tag/v7.2.5-beta.6","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97225","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908099","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409319","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409319/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97226","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T16:17:29.090","lastModified":"2026-09-24T18:19:09.063","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/src/controllers/files.js of the component files-style Endpoint. The manipulation of the argument filePath/uri leads to path traversal. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"DbGate","cpes":["cpe:2.3:a:dbgate:dbgate:*:*:*:*:*:*:*:*"],"modules":["files-style Endpoint"],"versions":[{"version":"7.2.0","status":"affected"},{"version":"7.2.1","status":"affected"},{"version":"7.2.2","status":"affected"},{"version":"7.2.3","status":"affected"},{"version":"7.2.4","status":"affected"},{"version":"7.2.5","status":"affected"},{"version":"7.3.1-premium-beta.0","status":"affected"},{"version":"7.3.1-premium-beta.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:20:59.603505Z","id":"CVE-2026-97226","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97226","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908139","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409320","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409320/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-26054","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:04.553","lastModified":"2026-09-28T16:17:14.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"SumatraPDF is a multi-format reader for Windows. Prior to 3.6, the MobiDoc::ParseHeader function in src/MobiDoc.cpp validates a record using kMobiHeaderMinLen but DecodeMobiDocHeader constructs a decoder sized for kMobiHeaderLen without receiving the actual remaining buffer length. A malformed MOBI file can use an attacker-controlled header length to bypass optional-field early returns and cause the decoder to read beyond a short heap buffer. Opening the crafted document can crash SumatraPDF. This issue is fixed in version 3.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"sumatrapdfreader","product":"sumatrapdf","versions":[{"version":"< 3.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:33:10.549166Z","id":"CVE-2026-26054","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/sumatrapdfreader/sumatrapdf/commit/24b9ce83383bbaa48b3efe00e4d30cccea126198","source":"security-advisories@github.com"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/issues/5318","source":"security-advisories@github.com"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/releases/tag/3.6rel","source":"security-advisories@github.com"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-27p6-wrfp-pgm8","source":"security-advisories@github.com"},{"url":"https://github.com/sumatrapdfreader/sumatrapdf/security/advisories/GHSA-27p6-wrfp-pgm8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-47132","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:04.723","lastModified":"2026-09-24T18:17:13.453","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search  filter and enumerate active users. The endpoint escapes SQL string syntax but does not escape `%` and `_`, which remain active `LIKE` wildcards. Version 4.2.0-alpha patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":"< 4.2.0-alpha","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:06:01.241141Z","id":"CVE-2026-47132","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-89"},{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/commit/bd4b08b012234ccfcff07bfe6518062475b29e0a","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6pvm-2vjj-rx4w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-56738","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:04.890","lastModified":"2026-10-05T16:17:14.313","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement using `sprintf()` and inserts the user-supplied stop word value directly into the query string without calling the application's database escaping function on it. A sibling method, `StopWords::update()`, which modifies an existing stop word, correctly escapes the same kind of input. The omission is isolated to the `add()` (insert) code path. An authenticated administrator who can reach the stop-word management feature can submit a crafted value as the \"word\" parameter that breaks out of the SQL string literal and injects arbitrary SQL, including statements to drop tables, exfiltrate data, or modify other rows in the database. Version 4.1.6 fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thorsten","product":"phpMyFAQ","versions":[{"version":"< 4.1.6","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:08.688016Z","id":"CVE-2026-56738","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/commit/d56ef5d75c3c007de095bc4c13b470c7ac783f0f","source":"security-advisories@github.com"},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rw77-vq4g-x3hp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56744","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:05.047","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"`@bsv/wallet-toolbox` provides BRC-100 wallet signing and storage components, while `@bsv/wallet-toolbox-client` and `@bsv/wallet-toolbox-mobile` provide client-focused distributions for standard and mobile applications using wallet storage services. A vulnerability in these packages causes transactions created through a remote `StorageClient` to trust output locking scripts returned by the storage provider without verifying that they match the outputs requested by the caller. A malicious or compromised storage provider can substitute a recipient script or inject an additional output, causing the wallet to sign and broadcast a transaction that redirects funds while the application and user interface continue to display the intended recipient. Source and npm publication history indicate that stable versions `@bsv/wallet-toolbox` and `@bsv/wallet-toolbox-client` from 1.1.47 through 2.3.3, and `@bsv/wallet-toolbox-mobile` from its initial 1.3.21 release through 2.3.3, are affected. All three packages are patched in version 2.4.0. Applications unable to upgrade should avoid remote `StorageClient` providers, use local storage, or independently verify every transaction output’s locking script and value against the original request before signing"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bsv-blockchain","product":"@bsv/wallet-toolbox","versions":[{"version":">= 1.1.47, < 2.4.0","status":"affected"}]},{"vendor":"bsv-blockchain","product":"@bsv/wallet-toolbox-client","versions":[{"version":">= 1.1.47, < 2.4.0","status":"affected"}]},{"vendor":"bsv-blockchain","product":"@bsv/wallet-toolbox-mobile","versions":[{"version":">= 1.3.21, < 2.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:17:06.726403Z","id":"CVE-2026-56744","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1288"}]}],"references":[{"url":"https://github.com/bsv-blockchain/ts-stack/commit/3a11f6111919245a3090e9f3895cfc4f21a80d28","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/ts-stack/commit/5492cabbef4ddc7f60cc49cdf5d8c74ed2e5d949","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/ts-stack/commit/5ee60395e78e8b822d9a78efeacc6039c249819b","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/wallet-toolbox/commit/ca651b067c0238cd8b1ddd3af225daa503857a07","source":"security-advisories@github.com"},{"url":"https://github.com/bsv-blockchain/ts-stack/security/advisories/GHSA-36f9-7rg5-cpf8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-62368","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:05.207","lastModified":"2026-09-29T16:50:07.450","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in CustomField.name, and app/Presenters/AssetPresenter.php assigns that value as an unescaped bootstrap-table header title. When another user opens an asset-list page associated with the fieldset, the stored markup executes on page load in that user's Snipe-IT session. This can expose same-origin data and perform authenticated actions with the victim's privileges, including privilege escalation when a superuser views the affected list. This issue is fixed in version 8.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grokability","product":"snipe-it","versions":[{"version":"< 8.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.7,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:13:19.981641Z","id":"CVE-2026-62368","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","versionEndExcluding":"8.7.0","matchCriteriaId":"F553C45E-A829-4438-BA02-5FA70B55FB5A"}]}]}],"references":[{"url":"https://github.com/grokability/snipe-it/commit/58754e4e3b86b58a0c4523012ef04a2ae990d2c8","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.7.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-p9h3-gvpq-5539","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63493","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:05.367","lastModified":"2026-09-29T18:49:38.127","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The advisory states that the resulting persistent API token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint. Resetting the administrator's enrolled second factor allows the password-holding attacker to enroll an attacker-controlled factor, take over the administrator's web account, and lock out the legitimate user. The token does not create a web session, but it provides broad API access while the same browser session remains blocked at the two-factor page. This vulnerability is fixed in 8.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grokability","product":"snipe-it","versions":[{"version":"< 8.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:54:07.180253Z","id":"CVE-2026-63493","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","versionEndExcluding":"8.7.0","matchCriteriaId":"F553C45E-A829-4438-BA02-5FA70B55FB5A"}]}]}],"references":[{"url":"https://github.com/grokability/snipe-it/commit/87c362962a670f427be071850b218e43eff5d08e","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/commit/c4ea7db51ca80bf11b1d04fbe46e4a64f54dc780","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/pull/19294","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.7.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-hxcx-9h4f-42xx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63498","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:05.513","lastModified":"2026-09-29T16:50:21.113","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{file_id} allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The app/Http/Controllers/Api/UploadedFilesController.php show() path does not apply the safe-inline allowlist used by the equivalent web controller, so the browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim who is authorized to view the object must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges. This issue is fixed in version 8.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"grokability","product":"snipe-it","versions":[{"version":"< 8.7.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:39:44.519362Z","id":"CVE-2026-63498","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*","versionEndExcluding":"8.7.0","matchCriteriaId":"F553C45E-A829-4438-BA02-5FA70B55FB5A"}]}]}],"references":[{"url":"https://github.com/grokability/snipe-it/commit/e929b31f0b183c5810bd2b833c1f6f643cbe5284","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/grokability/snipe-it/releases/tag/v8.7.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","source":"security-advisories@github.com","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://github.com/grokability/snipe-it/security/advisories/GHSA-396x-xmvh-p563","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-79762","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.220","lastModified":"2026-09-28T16:17:15.227","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, Termix derives the keys that wrap OIDC and WebAuthn users' Data Encryption Keys from committed default strings and the public userId salt in src/backend/utils/user-crypto.ts. Because OIDC_SYSTEM_SECRET and WEBAUTHN_SYSTEM_SECRET are not configured by the project's default deployment artifacts, an attacker with an offline SQLite database copy can derive the wrapping key, recover each affected user's DEK, and decrypt stored SSH passwords, private keys, and key passphrases. Password-authenticated users are not affected by this specific key derivation path. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 1.7.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:35:15.154188Z","id":"CVE-2026-79762","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/401ec7e8fc7d7f63739112e0b0897d6c97208eb8","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-685g-ccvv-6p8m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79763","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.370","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the POST /users/totp/disable and POST /users/totp/backup-codes endpoints accept the account password as the sole reauthentication factor after a 2.4.0 refactor regressed the two-factor check introduced for CVE-2026-45749. In src/backend/database/routes/user-totp-routes.ts, verifyTotpReauth returns success when bcrypt.compare validates the password, while each endpoint chooses password or totp_code as an interchangeable credential. An attacker who has a victim's authenticated session and knows the password can disable TOTP or regenerate and invalidate backup codes without an authenticator or valid second factor, weakening the account to single-factor authentication. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 2.4.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:08:38.740425Z","id":"CVE-2026-79763","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-308"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/22124e1bc49c8cedad57b31de9c51ad39f3d4432","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9h9-f7jc-8jwj","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-x9h9-f7jc-8jwj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79764","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.510","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In src/backend/database/routes/homepage-proxy-routes.ts, new URL performs only syntactic validation, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. The endpoint returns the complete fetched JSON response, so a low-privilege or self-registered account can exfiltrate internal service data and cloud credentials. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 2.5.0, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:19:08.241522Z","id":"CVE-2026-79764","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/4b2a60a854281d0e12e7c9bcde71854a81999ea0","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-mwr3-35ph-pjqg","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-mwr3-35ph-pjqg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-79766","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.650","lastModified":"2026-09-29T03:17:18.247","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In src/backend/database/routes/acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Termix-SSH","product":"Termix","versions":[{"version":">= 2.4.1, < 2.5.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:51:48.135823Z","id":"CVE-2026-79766","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://github.com/Termix-SSH/Termix/commit/c7a9063a72071153723e668787548766c971f029","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/commit/ddbdd5c437c2296607dfaa4265d6f63fbc1ca92e","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/pull/1067","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/releases/tag/release-2.5.1-tag","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-pr55-25gf-5f9v","source":"security-advisories@github.com"},{"url":"https://github.com/Termix-SSH/Termix/security/advisories/GHSA-pr55-25gf-5f9v","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-84302","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:06.793","lastModified":"2026-09-24T18:19:03.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages could appear in the moderator review queue of a moderator who was not a participant in the message. Reviewable visibility filtering did not restrict private-message reviewables to the audience permitted to access the underlying private-message topic, allowing the moderator to read otherwise confidential content. Depending on the available reviewable action, the moderator could also modify the private message by closing its topic or deleting a post. Exploitation requires an authenticated moderator account and a pre-existing Discourse AI reviewable associated with a private message. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.7.0","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.1","status":"affected"},{"version":">= 2026.5.0-latest, < 2026.5.2","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:04:31.550424Z","id":"CVE-2026-84302","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/1566d04524c01472375944bbf7b198dd09a99427","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/23488b72a200228e805c4e6d970fbad216d328c5","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/38d10c0e5d1b76540d2860455e0290f8e975c9fd","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/b323702d87cd82c327c116d9566477f3c4f9635f","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42091","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-3rx9-fqgh-wfpc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-88367","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:06.973","lastModified":"2026-09-25T18:17:31.597","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs() during SVG stroke rasterization. A specially crafted SVG document containing an extremely large stroke-width can cause floating-point rounding to produce a zero subdivision angle. The subsequent arc division yields infinity, which is converted to int without range validation, resulting in undefined behavior and process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:57:56.078398Z","id":"CVE-2026-88367","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/memononen/nanosvg/issues/293","source":"cve@mitre.org"},{"url":"https://github.com/memononen/nanosvg/issues/293","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88372","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.083","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:57:29.323451Z","id":"CVE-2026-88372","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/libsndfile/libsndfile/issues/1151","source":"cve@mitre.org"},{"url":"https://github.com/libsndfile/libsndfile/issues/1151","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88373","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.197","lastModified":"2026-09-25T18:17:31.937","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:24:11.917709Z","id":"CVE-2026-88373","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea","source":"cve@mitre.org"},{"url":"https://github.com/strukturag/libde265/issues/534","source":"cve@mitre.org"},{"url":"https://github.com/strukturag/libde265/issues/534","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88376","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.313","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:12:59.862454Z","id":"CVE-2026-88376","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://github.com/axiomatic-systems/Bento4/issues/1091","source":"cve@mitre.org"},{"url":"https://github.com/axiomatic-systems/Bento4/issues/1091","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88377","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.433","lastModified":"2026-09-29T03:17:20.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file containing an atom with a declared size smaller than AP4_ATOM_HEADER_SIZE can cause AP4_AvccAtom::Create() or AP4_HvccAtom::Create() to underflow the payload-size calculation. The resulting oversized buffer operation can cause invalid or NULL pointers to be passed to the AP4_DataBuffer copy path, resulting in application termination and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:34:23.040819Z","id":"CVE-2026-88377","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://github.com/axiomatic-systems/Bento4/issues/1092","source":"cve@mitre.org"},{"url":"https://github.com/axiomatic-systems/Bento4/issues/1092","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88378","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.550","lastModified":"2026-09-29T03:17:21.100","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag()."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:31:06.896356Z","id":"CVE-2026-88378","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/bellard/quickjs/issues/549","source":"cve@mitre.org"},{"url":"https://github.com/bellard/quickjs/pull/553","source":"cve@mitre.org"},{"url":"https://github.com/bellard/quickjs/pull/553/changes/42526037cfc0b2a94a875c0de0f4bbeaf597a542","source":"cve@mitre.org"},{"url":"https://github.com/bellard/quickjs/issues/549","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88382","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.670","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:04:13.893816Z","id":"CVE-2026-88382","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/redis/hiredis/issues/1357","source":"cve@mitre.org"},{"url":"https://github.com/redis/hiredis/issues/1357","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88383","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.787","lastModified":"2026-10-06T18:16:57.693","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a parameterized property, the function passes icalparameter_compare_kind_map() to bsearch() through an incompatible comparator function pointer type. bsearch() invokes the callback through the mismatched type, resulting in undefined behavior and process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:34:46.122313Z","id":"CVE-2026-88383","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://github.com/libical/libical/issues/1361","source":"cve@mitre.org"},{"url":"https://github.com/libical/libical/pull/1363","source":"cve@mitre.org"},{"url":"https://github.com/libical/libical/pull/1363/changes/557d9c043733b33a8511dce41fdeeb508460d5a9","source":"cve@mitre.org"},{"url":"https://github.com/libical/libical/issues/1361","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88384","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:07.907","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packed_data pointer. The OpaqueAttribute constructor passes the NULL pointer to memcpy() without validating the zero-size condition, resulting in undefined behavior and process termination, leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:17:56.727213Z","id":"CVE-2026-88384","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://github.com/AcademySoftwareFoundation/openexr/issues/2612","source":"cve@mitre.org"},{"url":"https://github.com/AcademySoftwareFoundation/openexr/pull/2615","source":"cve@mitre.org"},{"url":"https://github.com/AcademySoftwareFoundation/openexr/pull/2615/changes/70ddecfe82d2566f3776b8ed923939afd47baca2","source":"cve@mitre.org"},{"url":"https://github.com/AcademySoftwareFoundation/openexr/issues/2612","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88385","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:08.023","lastModified":"2026-10-06T18:16:57.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulting in a persistent memory leak on each parsing attempt. Repeated attacker-controlled requests can cause cumulative memory exhaustion and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-06T15:40:22.501112Z","id":"CVE-2026-88385","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-401"}]}],"references":[{"url":"https://github.com/michaelrsweet/mxml/commit/83ef80ae3c5413b73f501edb59ee74e31ce399d0","source":"cve@mitre.org"},{"url":"https://github.com/michaelrsweet/mxml/issues/356","source":"cve@mitre.org"},{"url":"https://github.com/michaelrsweet/mxml/issues/356","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88390","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T17:17:08.143","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input containing an overlong token to trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds. The out-of-bounds write corrupts the adjacent tokenValue pointer, resulting in memory corruption and potentially causing application crashes or denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:59:21.695501Z","id":"CVE-2026-88390","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/espruino/Espruino/commit/ecd7d43e084ba9aafa8245609347fe0f4383b38c","source":"cve@mitre.org"},{"url":"https://github.com/espruino/Espruino/issues/2744","source":"cve@mitre.org"},{"url":"https://github.com/espruino/Espruino/issues/2744","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91122","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:08.393","lastModified":"2026-09-24T18:19:06.763","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default Content Security Policy settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:25:16.666454Z","id":"CVE-2026-91122","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/05d92b8749f68d2626cbe65ec7adde7562a0283d","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/5674b3e6594825c28d2678e55057fd6802f11031","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/c3993e318e172389be5c98455177876f1dd87dda","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/d7126af3264b672d2201d84c18a37cb8627424a8","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-8m44-f6g9-7cg7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91123","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:08.560","lastModified":"2026-09-24T18:19:06.883","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location that the administrator did not allow. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:11:25.606443Z","id":"CVE-2026-91123","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/042d7b159beda4f74d23e245e8b2e396d9ff8318","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/097ce5600a2d74d9c68e57974597ab2684bd2a24","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/0b5a27e689925edce9ba9b14110022435d2b94be","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/142f5155ad8e56ddb8012c4e70c69a03dedc0579","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-6pwj-wgg8-4rjc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91132","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:08.723","lastModified":"2026-09-29T03:17:21.457","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed_iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched the allowed domain text, while browser URL parsing selected a different attacker-controlled origin. A user with posting privileges could exploit the flaw through a post or a Onebox oEmbed response and cause an attacker-controlled iframe to be rendered independently of the allowlisted domain. Successful exploitation requires a site-configured wildcard iframe pattern and the ability to create a post or trigger an oEmbed request for an attacker-controlled URL. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:57:23.434341Z","id":"CVE-2026-91132","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/80968704c1acb1d2ea2c6011dbf6c02ff13238e5","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/d5ae0940707f95da5bc4562f7b544243e3103f8a","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/d88e02ceb2eede4d8b851d9fe8aef753f3aa40b9","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/db8064f2a2a2a3feb3308a1c932ac61d950c9e56","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-4q3q-hph3-3rvp","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91133","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:08.893","lastModified":"2026-09-24T18:19:07.003","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unescaped SQL LIKE metacharacters to upload-resolution patterns, causing wildcard input to select unrelated upload records instead of matching a literal identifier. The affected upload metadata, URL-lookup, and cooked-video-placeholder paths could resolve uploads the user was not authorized to access. This allowed disclosure of restricted metadata, including original filenames and secure-upload paths, without modifying the upload records. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:12:40.098136Z","id":"CVE-2026-91133","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-943"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/113c34d433d564bc69642649d501251a7e820b52","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/20c48bef712ee3edd4f7af58ca1123cb0c16ef6f","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/a04cab107a9f57939456181c4b082d0a34ec39bd","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/cb3ca8420fcc7aba334effd011cf41943a336fa6","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-8hxh-573g-52gx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91134","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:09.080","lastModified":"2026-09-29T03:17:21.580","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a stored cross-origin iframe to bypass the allowed_iframes prefix policy when the iframe src contained encoded userinfo. The sanitizer validated a decoded form differently from the stored iframe src, allowing the browser to interpret an attacker-controlled host while the allowlist check accepted the encoded URL as an allowed prefix. An authenticated user with posting privileges could persist the iframe in a post and cause attacker-controlled cross-origin content to be rendered. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:56:20.350456Z","id":"CVE-2026-91134","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/0a8015e6c7a5079981843721494d30c9a91f5415","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/1304b0c04f87534053b0d574ae5a9b9ba13dd590","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/bac7dd1201911851462483271b4567246fa1309d","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/fed3a58c48412ce7207b72a4629ddbc44482cd64","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-54vw-chv3-wjpv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91160","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:09.257","lastModified":"2026-10-05T16:17:17.470","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through either wildcard subscription form, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When an allowed session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions, and deployments that issue only OPERATOR or ADMIN keys are not affected. This issue is fixed in version 0.23.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rmyndharis","product":"OpenWA","versions":[{"version":"< 0.23.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:53:06.862079Z","id":"CVE-2026-91160","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/rmyndharis/OpenWA/commit/acc23c3803c07f43791a92e8e48456572fd69bdc","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/commit/b9d9ea1c57bde98b7833a5d6e482998703667ef0","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/pull/1602","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-m427-j4h4-9qwj","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91161","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:09.437","lastModified":"2026-10-05T16:17:17.610","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-code endpoint and the GroupGetInviteCode MCP tool have no OPERATOR role requirement, allowing a valid VIEWER key scoped to a session to retrieve an active group invite code. The invite code is a transferable WhatsApp bearer capability, so an external account can join a group administered by the session without an OpenWA credential, gain read and post access to the group, and retain membership after the VIEWER key is revoked. Affected deployments are those that issue VIEWER keys to parties who should not be able to add accounts to administered groups; OPERATOR and ADMIN access is intended. This issue is fixed in version 0.23.5."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"rmyndharis","product":"OpenWA","versions":[{"version":"< 0.23.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:07.290059Z","id":"CVE-2026-91161","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/rmyndharis/OpenWA/commit/a888a0121543426d4e1bf55f9edaed8306ae2699","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/commit/d66439db9653c7aa7cbfb763003c8d3cbc8f623c","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/pull/1572","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/releases/tag/v0.23.5","source":"security-advisories@github.com"},{"url":"https://github.com/rmyndharis/OpenWA/security/advisories/GHSA-45fh-xj7x-vj2x","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-93284","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:09.587","lastModified":"2026-10-19T10:17:20.043","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/pagemap: dma-unmap pages before handling migration errors\n\ndrm_pagemap_migrate_unmap_pages() relies on the pages array to determine\nwhich pages require DMA unmapping. However,\ndrm_pagemap_migration_unlock_put_pages() clears the array as part of its\ncleanup, leaving drm_pagemap_migrate_unmap_pages() with no valid page\ninformation if it is called afterward.\n\nCall drm_pagemap_migrate_unmap_pages() before\ndrm_pagemap_migration_unlock_put_pages() so the pages array remains\nvalid during DMA unmapping."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/drm_pagemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f86ad0ed620cb3c91ec7d5468e93ac68d727539d","lessThan":"e4331c6644db85bc6ceb470bd84bcf371b6dbfa6","versionType":"git","status":"affected"},{"version":"f86ad0ed620cb3c91ec7d5468e93ac68d727539d","lessThan":"415f5a755cec5164b149037bf294e270b78d36c6","versionType":"git","status":"affected"},{"version":"f86ad0ed620cb3c91ec7d5468e93ac68d727539d","lessThan":"9e6372ec2a3990662ae0a67f56ac0aee19848d5b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/drm_pagemap.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.9","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/415f5a755cec5164b149037bf294e270b78d36c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e6372ec2a3990662ae0a67f56ac0aee19848d5b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e4331c6644db85bc6ceb470bd84bcf371b6dbfa6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93285","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:09.697","lastModified":"2026-10-21T13:21:07.627","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: embed f2fs_gc_kthread in f2fs_sb_info\n\nInstead of allocating f2fs_gc_kthread dynamically, embed it in\nf2fs_sb_info. This simplifies lifetime management and prepares for\nfixing race conditions during teardown.\n\n- __sbi_store\t\t\t- remount|shutdown\n\t\t\t\t - f2fs_stop_gc_thread\n - access sbi->gc_thread\n\t\t\t\t  - sbi->gc_thread = NULL\n - access sbi->gc_thread->f2fs_gc_task"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/f2fs/debug.c","fs/f2fs/f2fs.h","fs/f2fs/gc.c","fs/f2fs/gc.h","fs/f2fs/segment.c","fs/f2fs/super.c","fs/f2fs/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"cc004a1107e2c44cbdd2f1b1c2c85d32adc8f731","versionType":"git","status":"affected"},{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"7ee6be9ee7f9a803e0f539af26ab1154fdde48ba","versionType":"git","status":"affected"},{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"23eee01c732ec8c62b05416a05f0f88129df2960","versionType":"git","status":"affected"},{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"99d14d61aa8beb6cb9a984b9fcddd45e35b24494","versionType":"git","status":"affected"},{"version":"7950e9ac638e84518fbdd5c930939ad46a1068c5","lessThan":"3d7bca9d583793bb7d0bac0d95a24ddd2e129eed","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/f2fs/debug.c","fs/f2fs/f2fs.h","fs/f2fs/gc.c","fs/f2fs/gc.h","fs/f2fs/segment.c","fs/f2fs/super.c","fs/f2fs/sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.112","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2.5","lessThanOrEqual":"7.2.*","versionType":"semver","status":"unaffected"},{"version":"7.3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/23eee01c732ec8c62b05416a05f0f88129df2960","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d7bca9d583793bb7d0bac0d95a24ddd2e129eed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ee6be9ee7f9a803e0f539af26ab1154fdde48ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99d14d61aa8beb6cb9a984b9fcddd45e35b24494","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc004a1107e2c44cbdd2f1b1c2c85d32adc8f731","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93286","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:09.810","lastModified":"2026-10-03T11:17:47.133","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: appletalk: fix NULL pointer dereference in aarp_send_ddp()\n\naarp_send_ddp() calls atalk_find_dev_addr(dev) in the LocalTalk fast\npath without checking for NULL. When the device has no AppleTalk\ninterface configured (dev->atalk_ptr == NULL), this leads to a NULL\npointer dereference at the at->s_net access.\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: 0010:aarp_send_ddp (net/appletalk/aarp.c:552 (discriminator 2))\n Call Trace:\n  <TASK>\n  atalk_sendmsg (net/appletalk/ddp.c:1715)\n  __sys_sendto (net/socket.c:2265 (discriminator 1))\n  __x64_sys_sendto (net/socket.c:2272)\n  do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nAdd a NULL check consistent with the other callers of\natalk_find_dev_addr()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/appletalk/aarp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"51cc5e756cec6071ffc620076aebcf5bae936668","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8c4b9ceb1be780588c1c50d573d5ee308e0874d2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d643fd42ad96f19b5ce5cb11824fefa617191dbe","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"83899a056aeb120898a6e3a989971fc63e274e2e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9e7f36ab5b7bf68463faa5f7b926fea8f35597bb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/appletalk/aarp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/51cc5e756cec6071ffc620076aebcf5bae936668","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/542c1dd41e1b0cd1c2c3ba8091c7d882eea0d680","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83899a056aeb120898a6e3a989971fc63e274e2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c4b9ceb1be780588c1c50d573d5ee308e0874d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fc30f0cdf4207a5aa2341c0a98d0f1713b3ce2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9e7f36ab5b7bf68463faa5f7b926fea8f35597bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d643fd42ad96f19b5ce5cb11824fefa617191dbe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93287","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:09.930","lastModified":"2026-10-03T11:17:47.247","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: smbus: reject oversized block transfers in the common path\n\nThe SMBus block transfer length data->block[0] is validated in\ni2c_smbus_xfer_emulated() but that check runs too late for tracepoints\nand is skipped entirely when the adapter provides a native smbus_xfer\nimplementation. This allows user-controlled oversized block lengths to\nreach tracepoint memcpy calls and driver callbacks unchecked.\n\nAdd an early validation in __i2c_smbus_xfer() that rejects block\ntransfers whose caller-supplied length is zero or exceeds\nI2C_SMBUS_BLOCK_MAX before any tracepoint fires or driver callback\nruns. data->block[0] is filled in by the device on SMBus block reads,\nso the check is scoped to operations where the length is actually\nsupplied by the caller. This is consistent with the existing -EINVAL\nconvention in the emulated path and protects all downstream consumers\nat once: the smbus_write tracepoint, all native smbus_xfer driver\nimplementations, and the emulated path.\n\nTwo distinct bugs are fixed by this change:\n\nBug 1: smbus_write tracepoint OOB (include/trace/events/smbus.h)\n  trace_smbus_write() fires before any validation and copies\n  data->block[0]+1 bytes into a 34-byte event buffer. With\n  block[0]=0xfe the tracepoint copies 255 bytes, overflowing by 221.\n\n BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_smbus_write+0x27c/0x530\n Read of size 255 at addr ffff88800d98fcf8 by task poc_smbus/91\n Call Trace:\n  <TASK>\n  __asan_memcpy+0x23/0x80\n  trace_event_raw_event_smbus_write+0x27c/0x530\n  __i2c_smbus_xfer+0x43a/0xa40\n  i2c_smbus_xfer+0x19e/0x340\n  i2cdev_ioctl_smbus+0x38f/0x7f0\n  i2cdev_ioctl+0x35e/0x680\n  __x64_sys_ioctl+0x147/0x1e0\n  do_syscall_64+0xcf/0x15a0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  </TASK>\n\nBug 2: i2c-stub I2C_SMBUS_I2C_BLOCK_DATA OOB (drivers/i2c/i2c-stub.c)\n  stub_xfer() implements .smbus_xfer directly and only clamps\n  block[0] against 256-command, not I2C_SMBUS_BLOCK_MAX. With\n  block[0]=0xff and command=0 the loop accesses block[1+i] for\n  i up to 254, far past the 34-byte union.\n\n UBSAN: array-index-out-of-bounds in drivers/i2c/i2c-stub.c:223:44\n index 34 is out of range for type '__u8 [34]'\n Call Trace:\n  <TASK>\n  __ubsan_handle_out_of_bounds+0xd7/0x120\n  stub_xfer+0x1971/0x198f [i2c_stub]\n  __i2c_smbus_xfer+0x306/0xa40\n  i2c_smbus_xfer+0x19e/0x340\n  i2cdev_ioctl_smbus+0x38f/0x7f0\n  i2cdev_ioctl+0x35e/0x680\n  __x64_sys_ioctl+0x147/0x1e0\n  do_syscall_64+0xcf/0x15a0\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  </TASK>\n\nBoth traces reproduced on v7.0-rc6+i2c/for-current with KASAN+UBSAN."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i2c/i2c-core-smbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"856dffcc097b3d8ed45a643ebda07cb92968cb33","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"356875e33f2c6d2061a02c9dec1a1e639d265a55","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"72ca5e0b8b7a62615758f8871c34d61616c2dc8b","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"df077253f6405d67ad087538e495ef32a05717b7","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"f09edffba97d37b1fdff5f818a9a45f8a98ac171","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"c4b478bc50b7ca9865e237909941253a0f7111a2","versionType":"git","status":"affected"},{"version":"4710317891e4824ce1510a6b5066abbd3e917750","lessThan":"3051cd060fa496df42954291fa2306ed2eab4ecc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i2c/i2c-core-smbus.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3051cd060fa496df42954291fa2306ed2eab4ecc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/356875e33f2c6d2061a02c9dec1a1e639d265a55","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72ca5e0b8b7a62615758f8871c34d61616c2dc8b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/856dffcc097b3d8ed45a643ebda07cb92968cb33","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4b478bc50b7ca9865e237909941253a0f7111a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df077253f6405d67ad087538e495ef32a05717b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f09edffba97d37b1fdff5f818a9a45f8a98ac171","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93288","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:10.070","lastModified":"2026-10-03T11:17:47.413","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state\n\nsashiko reports: \"nfnl_log_net_exit() calls nf_log_unset(), which\nclears the logger pointer without an RCU grace period.  Immediately after,\nops_free_list() frees the per-net state while concurrent packets might\nstill be executing nf_log_packet() under rcu_read_lock().\"\n\nClear the pointer via .pre_exit to make sure rcu readers have completed\nbefore pernet storage is free'd.  The change in nf_log_syslog.c is only\ndone for consistency: it doesn't use pernet data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_log_syslog.c","net/netfilter/nfnetlink_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"ba2e246aa294f9acd86194ea87fb6834ed0a37ac","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"5570d6c8b320dbcc602617ee08c27ce752fed65a","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"3b9aa62d78ce80de47af2db472ff452398755213","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"f4461654374576e9d5d0245fd534c46ad8509051","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"dc20050b6b12ca58066715d088e1a537535d938d","versionType":"git","status":"affected"},{"version":"c83fa19603bdaeef17b815713dbbe3230c8a34ee","lessThan":"33d1469b0124cc0baaea7a2032123b77a81e0940","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_log_syslog.c","net/netfilter/nfnetlink_log.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/33d1469b0124cc0baaea7a2032123b77a81e0940","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b9aa62d78ce80de47af2db472ff452398755213","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5570d6c8b320dbcc602617ee08c27ce752fed65a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba2e246aa294f9acd86194ea87fb6834ed0a37ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc20050b6b12ca58066715d088e1a537535d938d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f4461654374576e9d5d0245fd534c46ad8509051","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93542","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:10.183","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:18:15.511330Z","id":"CVE-2026-93542","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=f499944ad595b9bd7e7571c810842244caf150aa","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-93543","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:10.307","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:16:58.657195Z","id":"CVE-2026-93543","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=e2089ab748828273f916bbffd4e65b506aa50fdc","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-93544","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:10.430","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attached X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:16:25.106730Z","id":"CVE-2026-93544","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=a88a341135b79f6ed450f481e4a5d6ba502382af","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-93545","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:10.550","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:14:35.552977Z","id":"CVE-2026-93545","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=234ce17d95c42d75f7f7fdb2bf7a24875451bc0a","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-93781","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:10.670","lastModified":"2026-10-03T11:17:47.550","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Do not block on tag allocation in scsi_eh_lock_door()\n\nscsi_eh_lock_door() is called from scsi_restart_operations() while the\nhost is still in the SHOST_RECOVERY state, i.e. before the host is\nswitched back to SHOST_RUNNING and scsi_run_host_queues() restarts the\nqueues. It allocates a request via scsi_alloc_request() with no flags,\nso blk_mq_get_tag() may block waiting for a free sched tag when all tags\nare already in use.\n\nThose tags can be held by commands that were just requeued by\nscsi_eh_flush_done_q() during error handling. Such commands cannot be\ndispatched until the host leaves SHOST_RECOVERY and\nscsi_run_host_queues() is called - which only happens *after*\nscsi_eh_lock_door() returns.\n\nThis forms a circular dependency:\n\n  - scsi_eh_lock_door(), running in the SCSI error handler thread, waits\n    for a sched tag held by a requeued command;\n\n  - the requeued command cannot complete and release its sched tag until\n    the error handler thread leaves scsi_restart_operations() and restart\n    the queues.\n\nFor devices with a single driver tag (e.g. USB storage) it is a\nguaranteed deadlock and I/O that can never be submitted. This problem\nhas also been reproduced in our environment.\n\nLocking the door is a best-effort operation, and scsi_eh_lock_door()\nalready returns silently when the request allocation fails. Pass\nBLK_MQ_REQ_NOWAIT to scsi_alloc_request() so the allocation fails\ninstead of blocking when no tag is available. This breaks the circular\ndependency and allows the error handler to finish restarting the queues,\nafter which the pending commands are dispatched normally."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/scsi/scsi_error.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"3bc7af4cefac1c583f0607f6183a67012436aad9","versionType":"git","status":"affected"},{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"6b450c277c106c4e31411067f025d1aaa27c2a02","versionType":"git","status":"affected"},{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"261c80a6b23e34ba98bcf3f75317e35ecf0a08f0","versionType":"git","status":"affected"},{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"dc9e1b6b9080dd6374cc9a38e4b53abca63c3b1b","versionType":"git","status":"affected"},{"version":"6e68af666f5336254b5715dca591026b7324499a","lessThan":"732cb6bb37fd26863d5786522fb1997e7f5865b4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/scsi/scsi_error.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","lessThan":"2.6.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/261c80a6b23e34ba98bcf3f75317e35ecf0a08f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3bc7af4cefac1c583f0607f6183a67012436aad9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b450c277c106c4e31411067f025d1aaa27c2a02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/732cb6bb37fd26863d5786522fb1997e7f5865b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc9e1b6b9080dd6374cc9a38e4b53abca63c3b1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93782","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:10.793","lastModified":"2026-10-03T11:17:47.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvhost-scsi: flush backend after device ioctls\n\nvhost-scsi translates guest response descriptors into userspace iovecs\nwhen commands are submitted.  Target-core completes those commands\nasynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while\nan in-flight command still retains response iovecs translated through the\nold table.\n\nIf the old mapping is reused after VHOST_SET_MEM_TABLE returns, command\ncompletion can write the response to an unrelated userspace object.\n\nFlush the vhost-scsi backend after vhost_dev_ioctl() handles a device\nioctl.  This waits for in-flight commands that can still use the old\nresponse iovecs before the ioctl returns."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/vhost/scsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"6436411203d8c702ffc055700f1a6bde488ff681","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"cec088285adcc7ae23c119b6bbdb22270dc2de8f","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"e0bf6bed528693a6b32439ab122b34a34b66d96f","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"be2636e1b21fe860db918152abf2932638d06ed7","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"981c97d09c6b9560bb12dcc41f11ce59b1a48e97","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"6c1b802e36b05ebd9d41686c4dce6f06966af469","versionType":"git","status":"affected"},{"version":"057cbf49a1f08297877e46c82f707b1bfea806a8","lessThan":"22598f55a4c2b510b3df5e69e563387a963222ae","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/vhost/scsi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.6","status":"affected"},{"version":"0","lessThan":"3.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.1,"impactScore":6.0}]},"references":[{"url":"https://git.kernel.org/stable/c/22598f55a4c2b510b3df5e69e563387a963222ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6436411203d8c702ffc055700f1a6bde488ff681","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c1b802e36b05ebd9d41686c4dce6f06966af469","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/981c97d09c6b9560bb12dcc41f11ce59b1a48e97","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/be2636e1b21fe860db918152abf2932638d06ed7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cec088285adcc7ae23c119b6bbdb22270dc2de8f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0bf6bed528693a6b32439ab122b34a34b66d96f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93783","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:10.907","lastModified":"2026-10-03T11:17:47.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: validate skb length in rfcomm_recv_frame\n\nrfcomm_recv_frame() casts skb->data to struct rfcomm_hdr and dereferences\nhdr->addr and hdr->ctrl without validating skb->len first. A truncated\nframe with skb->len less than the minimum header size causes an\nout-of-bounds read of uninitialized memory. Additionally, a zero-length\nframe causes skb->len-- to underflow to UINT_MAX, making\nskb_tail_pointer() read far past the buffer.\n\nCommit 23882b828c3c (\"Bluetooth: RFCOMM: validate skb length in MCC\nhandlers\") fixed the same class of missing-length-check bugs in the MCC\nsub-handlers, but the top-level rfcomm_recv_frame() was left unfixed.\nKMSAN reports:\n\n  BUG: KMSAN: uninit-value in rfcomm_run\n  ...\n  Uninit was created at:\n    __alloc_skb+0x474/0xb60\n    vhci_write+0xe9/0x870\n\nFix this by rejecting frames smaller than sizeof(struct rfcomm_hdr) + 1\n(the minimum frame must have a 3-byte header and a 1-byte FCS)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/rfcomm/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fb40eda15122f6b780228639c1ead6820340ff54","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3829af5fab5a22405bf1e7d69068c2ec0fce46ca","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b161eacd7fa4a2d765724b5504ac6cc388e48f80","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"30d1d9f3495463f7c026e4c553127f79b486fcd6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"67dc3b40fae71b6b11c71e7ff69bac0758818c05","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b230e5bf501c5edaf2eb0991cb862ac142031d4b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/rfcomm/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/30d1d9f3495463f7c026e4c553127f79b486fcd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3829af5fab5a22405bf1e7d69068c2ec0fce46ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/67dc3b40fae71b6b11c71e7ff69bac0758818c05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b161eacd7fa4a2d765724b5504ac6cc388e48f80","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b230e5bf501c5edaf2eb0991cb862ac142031d4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bbc310caa2b6bf5fe42896ba27da0fbc12e4ac51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fb40eda15122f6b780228639c1ead6820340ff54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93784","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.017","lastModified":"2026-10-03T11:17:47.927","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate IEs in cfg80211_wext_siwgenie()\n\nThe KASAN allocation trace shows that a malformed IE buffer is\nstored via SIOCSIWGENIE (cfg80211_wext_siwgenie()) without any\nvalidation. The crash trace shows that a subsequent SIOCSIWESSID\ntriggers a connection attempt which calls cfg80211_sme_get_conn_ies()\nto process the stored IE buffer, causing:\n\n - An out-of-bounds read in skip_ie() which reads ies[pos+1]\n   (the length byte) past the end of the 1-byte buffer.\n\n - An integer underflow in the memcpy size argument when offs\n   returned by ieee80211_ie_split() exceeds ies_len, causing\n   unsigned subtraction to wrap to SIZE_MAX and triggering a\n   fortify panic.\n\nFix this by validating the IE buffer in cfg80211_wext_siwgenie()\nbefore storing it.\n\n[drop unnecessary ie_len check, update commit message]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/wext-sme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"269498ce6c1e2132b072aa0c8660404926008f03","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"685082f4be77f4657b498ebbe9f942ef65c492cf","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"8b921a8993469a3482e0c67b5ce5cb6ce93f5f61","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"d01f1600e8b075aa17adb751ac9881bb6ee40dcc","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"c970879e03b23a27df42caf7ba506485a165fb96","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"01cc395cecfaa73134d39fb9a401d9605d8bb2c5","versionType":"git","status":"affected"},{"version":"f21293549f60f88c74fcb9944737f11048896dc4","lessThan":"a2f5286ca4f304d3fd469f01b96b518608912a5c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/wext-sme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/01cc395cecfaa73134d39fb9a401d9605d8bb2c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/269498ce6c1e2132b072aa0c8660404926008f03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/685082f4be77f4657b498ebbe9f942ef65c492cf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b921a8993469a3482e0c67b5ce5cb6ce93f5f61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2f5286ca4f304d3fd469f01b96b518608912a5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c970879e03b23a27df42caf7ba506485a165fb96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d01f1600e8b075aa17adb751ac9881bb6ee40dcc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93785","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.130","lastModified":"2026-10-03T11:17:48.050","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: validate idmap key payload length\n\nThe cifs.idmap key type stores its payload length in key->datalen, which\nis limited to U16_MAX.  Accepting a larger key payload truncates the\nrecorded length and can make later users interpret the payload using\ninconsistent bounds.\n\nReject oversized preparsed payloads before allocating or copying them.\nThis keeps key->datalen consistent with the stored data for both inline\nand separately allocated idmap payloads."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"eeac976b74b4f697cfc517187b7cbfd72652dbbc","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"125b05ac8ca8758950e4369c1542d57a162f504c","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"945f6cde6bcf8f08f6fa5df8882b1b9582e55efa","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"3a4a34a732e8a08309eed0a74314dbd9f2f1c972","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"6cfeef221ac00d63c07f6122f58e6159bde69ca0","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"8b12f65d7caf16d124098cb4895a203367d35b57","versionType":"git","status":"affected"},{"version":"21fed0d5b763b94a7d1568c27d0cce892ab8d43e","lessThan":"455488cd5054bcc59db40fa1cc2c004031a5b2a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/cifsacl.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/125b05ac8ca8758950e4369c1542d57a162f504c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a4a34a732e8a08309eed0a74314dbd9f2f1c972","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/455488cd5054bcc59db40fa1cc2c004031a5b2a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6cfeef221ac00d63c07f6122f58e6159bde69ca0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b12f65d7caf16d124098cb4895a203367d35b57","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/945f6cde6bcf8f08f6fa5df8882b1b9582e55efa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eeac976b74b4f697cfc517187b7cbfd72652dbbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93786","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.243","lastModified":"2026-10-03T11:17:48.163","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: preserve VFS inherited POSIX ACL mask\n\nThe VFS initializes a child's POSIX ACL from the parent's default ACL and\nthe requested creation mode. Do not mutate the parent ACL or overwrite the\nchild's VFS-computed access and default ACLs afterwards.\n\nThis preserves restrictive ACL_MASK entries and prevents SMB object creation\nfrom widening effective permissions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"4a19bb1c45667f5a5f6eff9cf6648e0f692d046f","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"591acf171644de590cda245fd8595b473a1beb70","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"0093909becbda22b62b39b654dbc607faed59cd0","versionType":"git","status":"affected"},{"version":"f44158485826c076335d6860d35872271a83791d","lessThan":"e148e567a9252643baa125cb65d7ae9c2c6cf68a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0093909becbda22b62b39b654dbc607faed59cd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a19bb1c45667f5a5f6eff9cf6648e0f692d046f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/591acf171644de590cda245fd8595b473a1beb70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e148e567a9252643baa125cb65d7ae9c2c6cf68a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93787","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.363","lastModified":"2026-10-03T11:17:48.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: bound dirent name against end of SMB response in cifs_filldir\n\ncifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST /\nFIND_NEXT response using a length (de.namelen) supplied by the server.\nThe kmalloc'd SMB response buffer is bounded, but nothing checks that\nde.name + de.namelen still lies inside that buffer before the eventual\nfilldir64() -> verify_dirent_name() -> memchr() reads namelen bytes.\n\nA hostile SMB1 server that returns an oversized FileNameLength in a\ndirectory entry therefore causes memchr() to read past the end of the\nresponse slab buffer. Reachable from any user who can list a directory\non a CIFS mount served by an attacker-controlled server (getdents64()\non the mounted directory):\n\n  BUG: KASAN: slab-out-of-bounds in memchr+0x71/0x80\n  Read of size 1 at addr ffff88800e0640cc by task poc/115\n  Call Trace:\n   dump_stack_lvl+0x64/0x80\n   print_report+0xce/0x620\n   kasan_report+0xec/0x120\n   memchr+0x71/0x80\n   filldir64+0x4c/0x6a0\n   cifs_filldir.constprop.0+0x9bb/0x1e00\n   cifs_readdir+0x2101/0x3380\n   iterate_dir+0x19c/0x520\n   __x64_sys_getdents64+0x126/0x210\n   do_syscall_64+0x107/0x5a0\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nPass the end-of-response pointer down to cifs_filldir() and reject\nentries whose name would extend past that boundary.\n\nThis bug was discovered by Artiphishell's vTriage pipeline, which\ngenerated a userspace reproducer (an emulated hostile SMB1 server plus\na getdents64() client) that reliably triggers the KASAN report on an\nunpatched kernel. The fix below was drafted with the Claude coding\nassistant; a userspace reproducer is available on request."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4cb3d79beee0fecc739ce07af915d503f29ae557","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cf87ef1e62ed31a439064cef69d6eec38c68bd92","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6e3b965267b7313903baba2739992b1e2e92d540","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"03003506c86f90312b0966283662c42fcab66e4b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/readdir.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/03003506c86f90312b0966283662c42fcab66e4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cb3d79beee0fecc739ce07af915d503f29ae557","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e3b965267b7313903baba2739992b1e2e92d540","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf87ef1e62ed31a439064cef69d6eec38c68bd92","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8cf09a53a0dc1da298e9dd0ba5f21710cf119d6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93788","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.477","lastModified":"2026-10-03T11:17:48.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: acpi: validate WGDS table revision index\n\nCheck tbl_rev bounds before BIT(tbl_rev) to avoid undefined shifts when\nfirmware reports an invalid revision value."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/fw/acpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"4f2ec7a0b3ff148cb13e14cb26ac43523df8b9f5","versionType":"git","status":"affected"},{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"9096509e63ddd349eb075ec447d1a714e87e17a4","versionType":"git","status":"affected"},{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"2fc98ab6fe8acabd13eb09dc17426a33cf9f27f7","versionType":"git","status":"affected"},{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"346a558491241cbe8fef82b3d8f62d1a6b6bf61f","versionType":"git","status":"affected"},{"version":"97f8a3d1610b1f50013de1e632b007cbfd7459d8","lessThan":"954e821f42aaca56073ca830c5fd4bcf1a89048c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/fw/acpi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2fc98ab6fe8acabd13eb09dc17426a33cf9f27f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/346a558491241cbe8fef82b3d8f62d1a6b6bf61f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f2ec7a0b3ff148cb13e14cb26ac43523df8b9f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9096509e63ddd349eb075ec447d1a714e87e17a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/954e821f42aaca56073ca830c5fd4bcf1a89048c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93789","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.593","lastModified":"2026-10-03T11:17:48.563","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: bound aligned TLV advance in FW parser\n\nValidate ALIGN(tlv_len, 4) against remaining parser length before\nconsuming bytes from the firmware image.\n\nThis avoids length underflow on malformed TLVs."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/iwl-drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"61da42fdd21d98ccb8f1ec5224659f3d09202cf4","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"8c332d45b736d41301b7e07f322785d821265dbc","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"ce709fcab5e1d4df6d4ba980736dc5908502a40f","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"4cfadb2e01566bc36d42922fbe18838345087050","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"528fa9eb14c209533ca26958b76da55e0ce239d8","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"7aa9097623afb694bc25382a62e14d8e82bf002f","versionType":"git","status":"affected"},{"version":"dd7a2509b3a79b290730a9c6a784bf03fedabb9a","lessThan":"acad742714bdc70e7fd7f234323807c596828213","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/iwl-drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.35","status":"affected"},{"version":"0","lessThan":"2.6.35","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4cfadb2e01566bc36d42922fbe18838345087050","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/528fa9eb14c209533ca26958b76da55e0ce239d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61da42fdd21d98ccb8f1ec5224659f3d09202cf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7aa9097623afb694bc25382a62e14d8e82bf002f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c332d45b736d41301b7e07f322785d821265dbc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/acad742714bdc70e7fd7f234323807c596828213","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce709fcab5e1d4df6d4ba980736dc5908502a40f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93790","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.710","lastModified":"2026-10-03T11:17:48.677","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix out-of-bounds tid_data access in BA notif\n\nmvmsta->tid_data was indexed by the TFD loop counter 'i' instead of\nthe actual TID value 'tid'. This writes lq_color into a random tid_data\nslot unrelated to the BA entry.\nSince multi-TID blockack is not really in use, 'i' was always 0 and no\nharm was done.\nAdd a out-of-bound check before accessing the array."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"41fd2fec56db2564f02532ed7244e1f69193b4ad","lessThan":"35f991d685feafd27255bd33272512c434e52527","versionType":"git","status":"affected"},{"version":"41fd2fec56db2564f02532ed7244e1f69193b4ad","lessThan":"c48b741277b01b2c3b4ecccedc72fc575b71dc04","versionType":"git","status":"affected"},{"version":"41fd2fec56db2564f02532ed7244e1f69193b4ad","lessThan":"e8ac5e91b1296f65c3d119fac3fa917ff458f811","versionType":"git","status":"affected"},{"version":"41fd2fec56db2564f02532ed7244e1f69193b4ad","lessThan":"94d3982806c7f194b23484befde12934dda23064","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/35f991d685feafd27255bd33272512c434e52527","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/94d3982806c7f194b23484befde12934dda23064","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c48b741277b01b2c3b4ecccedc72fc575b71dc04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8ac5e91b1296f65c3d119fac3fa917ff458f811","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93791","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.820","lastModified":"2026-10-03T11:17:48.800","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: add a check on the tid coming from the firmware\n\nba_notif->tid is a firmware-controlled u8 that is used directly\nas an array index into tid_data[] without any validation. Add a\nbounds check against IWL_MAX_TID_COUNT before dereferencing the\narray."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c46e7724bfe9bbff17bc468903a757248b99e4ed","lessThan":"0f690fd3b5535d110898b99ae6214f29c9060941","versionType":"git","status":"affected"},{"version":"c46e7724bfe9bbff17bc468903a757248b99e4ed","lessThan":"0b5325a0771674f1d65618de7db3df9d49186a12","versionType":"git","status":"affected"},{"version":"c46e7724bfe9bbff17bc468903a757248b99e4ed","lessThan":"59f64c2839022f41a7867b38f9e38c185ff39283","versionType":"git","status":"affected"},{"version":"c46e7724bfe9bbff17bc468903a757248b99e4ed","lessThan":"0e4c0d83267261cf67ec9690856edf4a56bb7dfc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b5325a0771674f1d65618de7db3df9d49186a12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0e4c0d83267261cf67ec9690856edf4a56bb7dfc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0f690fd3b5535d110898b99ae6214f29c9060941","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59f64c2839022f41a7867b38f9e38c185ff39283","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93792","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:11.933","lastModified":"2026-10-03T11:17:48.900","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix a possible underflow\n\nWe shouldn't trust the firmware about the length of the wowlan packet."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f444eb10d537c776ce82fbcd07733d75f45346f1","lessThan":"3ea815f401652003c2eec3b8969f74526f1342f0","versionType":"git","status":"affected"},{"version":"f444eb10d537c776ce82fbcd07733d75f45346f1","lessThan":"38ad8339211bf24c19126ec7629ea52094676454","versionType":"git","status":"affected"},{"version":"f444eb10d537c776ce82fbcd07733d75f45346f1","lessThan":"83f32942a501c80f44b8a8f668bc8b56d5d0d43f","versionType":"git","status":"affected"},{"version":"f444eb10d537c776ce82fbcd07733d75f45346f1","lessThan":"0cb5260a1027a43f8cdb961e128f2ddd42e46832","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/d3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0cb5260a1027a43f8cdb961e128f2ddd42e46832","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38ad8339211bf24c19126ec7629ea52094676454","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ea815f401652003c2eec3b8969f74526f1342f0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83f32942a501c80f44b8a8f668bc8b56d5d0d43f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93793","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.050","lastModified":"2026-10-21T13:21:07.833","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: validate TX_CMD response layout\n\nTX_CMD parsing uses frame_count to walk status entries and then\nread the trailing SCD SSN. Make the minimum-length check follow\nthat exact runtime layout calculation before parsing the payload.\n\nFor new TX API, reject TX_CMD responses with frame_count != 1 and\nwarn/return in the aggregation handler to document that aggregated\naccounting is expected via BA notifications."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c","lessThan":"5e871c03506c529d5fe372d099c1ad1465c7bc38","versionType":"git","status":"affected"},{"version":"8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c","lessThan":"fc14f5fe8a4374ed1088cfbddc1dae4d16c9935b","versionType":"git","status":"affected"},{"version":"8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c","lessThan":"4d942dfc13aec393e003ab28ff58db744c26e6eb","versionType":"git","status":"affected"},{"version":"8ca151b568b67a7b72dcfc6ee6ea7c107ddd795c","lessThan":"8d70881707b47353359df57df12f6de67fdacdd2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/tx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.9","status":"affected"},{"version":"0","lessThan":"3.9","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/4d942dfc13aec393e003ab28ff58db744c26e6eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e871c03506c529d5fe372d099c1ad1465c7bc38","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d70881707b47353359df57df12f6de67fdacdd2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc14f5fe8a4374ed1088cfbddc1dae4d16c9935b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93794","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.160","lastModified":"2026-10-03T11:17:49.000","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: flush dirty data before punching a hole\n\nPunching a hole after a large buffered write may leave the range\nreported as data. Reproduce it with:\n\n  xfs_io -f \\\n    -c \"pwrite -b 3m -S 0x61 0 3m\" \\\n    -c \"fpunch 1m 1m\" \\\n    -c \"seek -h 0\" \\\n    -c \"seek -d 1m\" \\\n    /mnt/test/repro\n\nPunching 1 MiB at offset 1 MiB should produce:\n\n  0          1 MiB       2 MiB       3 MiB\n  |  DATA    |   HOLE    |   DATA    | EOF\n\nInstead, the entire file is reported as data. SEEK_HOLE(0) returns EOF,\nand SEEK_DATA(1M) returns 1M.\n\nThis happens because a dirty folio spanning the punched range can be\nwritten back after the punch and refill the hole.\n\nFix this by flushing and waiting for dirty data in the punched range\nbefore invalidating the page cache and issuing FSCTL_SET_ZERO_DATA.\n\nThe xfstests generic/539 pass against Samba/ksmbd with this change."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"216e469586057c29409e4ef8311d282388c6e251","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"6c265aca08155e519a8f6f6071c59dff4f535f70","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"39562a56cdb515f6635c3e7bfe6629439b18a169","versionType":"git","status":"affected"},{"version":"31742c5a331766bc7df6b0d525df00c6cd20d5a6","lessThan":"d7d2adcd022baade5cab65ca492ce63421ce3a6e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.17","status":"affected"},{"version":"0","lessThan":"3.17","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/216e469586057c29409e4ef8311d282388c6e251","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/39562a56cdb515f6635c3e7bfe6629439b18a169","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c265aca08155e519a8f6f6071c59dff4f535f70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7d2adcd022baade5cab65ca492ce63421ce3a6e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93795","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.270","lastModified":"2026-10-03T11:17:49.107","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: fix leaks and online flag on radix_tree_insert failure\n\nWhen radix_tree_insert() fails in blkg_create(), the error path has two\nissues:\n\n1. blkg->online is set to true unconditionally, even when the blkg was\n   never fully inserted.  Move the assignment inside the success block.\n\n2. The error path calls blkg_put() without first calling\n   percpu_ref_kill().  Because the refcount is still in percpu mode,\n   percpu_ref_put() only does this_cpu_sub() without checking for zero,\n   so blkg_release() is never triggered.  This permanently leaks the\n   blkg memory, its percpu iostat, policy data, the parent blkg\n   reference, and the cgroup css reference — the latter preventing the\n   cgroup from ever being destroyed.\n\nFix by replacing blkg_put() with percpu_ref_kill(), matching the pattern\nused in blkg_destroy()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["block/blk-cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"0f840db042caee9d2f3dcdcf97d6674f6e4c1e30","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"f53945d7c712efe63fadbcc5ffed6370871fd0d3","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"ada8270ccdb6f212da5eb22614c28ea418746a4a","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"c3650be82ef6e7af13b79b2d10a7363bdf54aa7f","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"6e85f02d45b5977c0326a8d854c6db878aa6b34a","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"4c0d150fb98ea40760611979f4e664c244b20966","versionType":"git","status":"affected"},{"version":"7fcf2b033b84e261dca283bc2911aaea4b07b525","lessThan":"dbbca20764382b4d411ec2918f4e278ffe547acc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["block/blk-cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0f840db042caee9d2f3dcdcf97d6674f6e4c1e30","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c0d150fb98ea40760611979f4e664c244b20966","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e85f02d45b5977c0326a8d854c6db878aa6b34a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ada8270ccdb6f212da5eb22614c28ea418746a4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3650be82ef6e7af13b79b2d10a7363bdf54aa7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbbca20764382b4d411ec2918f4e278ffe547acc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f53945d7c712efe63fadbcc5ffed6370871fd0d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93796","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.383","lastModified":"2026-10-21T13:21:07.997","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: pcie: null RX pointers after free\n\nWhen iwl_pcie_tx_init() fails after RX init, nic init unwinds via\niwl_pcie_rx_free().\n\nThe freed RX members stayed non-NULL on the live transport object,\nso later teardown or retry could touch stale RX state.\nSet rx_pool, global_table, rxq, and alloc_page to NULL after free\nto make repeated cleanup and retry paths safe."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9cf671d60fdbeb8f875859c11148cf13c326ada2","lessThan":"c422d5d53f135ea987f745773953a91f9fe30c3f","versionType":"git","status":"affected"},{"version":"9cf671d60fdbeb8f875859c11148cf13c326ada2","lessThan":"6ec5bf430cf7466cb412e47f2761594092781fac","versionType":"git","status":"affected"},{"version":"9cf671d60fdbeb8f875859c11148cf13c326ada2","lessThan":"3456c5bcc987aeb182e50e30c9b02be8420e9953","versionType":"git","status":"affected"},{"version":"9cf671d60fdbeb8f875859c11148cf13c326ada2","lessThan":"2c79d7a7b583050c9f58041465cb46fe3483ab5d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/pcie/gen1_2/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2c79d7a7b583050c9f58041465cb46fe3483ab5d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3456c5bcc987aeb182e50e30c9b02be8420e9953","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ec5bf430cf7466cb412e47f2761594092781fac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c422d5d53f135ea987f745773953a91f9fe30c3f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93797","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.500","lastModified":"2026-10-03T11:17:49.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix an off-by-1 boundary check\n\nBefore looking at the 11th byte, check the length is big enough."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"2c8c06c59ed72a42e4d32e222542b582b4911459","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"23d3fddddd2bcedb4fd6cec5bef16b1fbb563019","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"45fcdbae679861b90f08964a0c3e9eead3bacd6f","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"7a2d4efea2c41b49db90907c8b6f37f8b63a9f50","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"1e3b72c9b63288a5f204e2c8f38eae01515d7dc5","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"4d60332387336088e66cc8f1e71e516b6b872ef9","versionType":"git","status":"affected"},{"version":"4f58121dc40a1d5dd2f630a5ec4dac5afa1ce3f4","lessThan":"d77aff138c9ec6c8562f4c2c9f262d3d9c4b4cb8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1e3b72c9b63288a5f204e2c8f38eae01515d7dc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/23d3fddddd2bcedb4fd6cec5bef16b1fbb563019","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c8c06c59ed72a42e4d32e222542b582b4911459","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/45fcdbae679861b90f08964a0c3e9eead3bacd6f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4d60332387336088e66cc8f1e71e516b6b872ef9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a2d4efea2c41b49db90907c8b6f37f8b63a9f50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d77aff138c9ec6c8562f4c2c9f262d3d9c4b4cb8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93798","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.607","lastModified":"2026-10-03T11:17:49.337","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix reloc root cleanup in merge_reloc_roots()\n\nIf the root we got has zero root refs in its root item, we are resetting\nthe root's ->reloc_root without using barriers like we do everywhere else.\nSashiko complained about this while reviewing another patch, and it's\ncorrect (see the Link tag below).\n\nAlso, we should not clear BTRFS_ROOT_DEAD_RELOC_TREE from the root unless\nthe root points to the reloc root we have.\n\nFix this by using clear_reloc_root(), which issues the memory barrier\nafter setting the root's ->reloc_root to NULL and before clearing the bit\nBTRFS_ROOT_DEAD_RELOC_TREE from the root."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/relocation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"29531470b1bf1e8bd2df4941fe913106edbca615","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"415f8665a969d3c906e4fd7c90fcbb4b357886f6","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"ee695a968aa73b1e67ccbf2133dc0e54381d32b2","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"0bc25f0a2d1b3e0a691431c4d7aef36afcd527c5","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"ab48583aa9948205ff9a6470e23dbff74c565e24","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"63d6b1f04cd91c825329712aa526215ffa5d11ca","versionType":"git","status":"affected"},{"version":"1dae7e0e58b484eaa43d530f211098fdeeb0f404","lessThan":"b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8","versionType":"git","status":"affected"},{"version":"ee08663380ffd5a45a1c87580fbc305e8413c235","versionType":"git","status":"affected"},{"version":"33823378ff2b510fd7b566f25bb18438aeb9b23b","versionType":"git","status":"affected"},{"version":"5.4.54","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.7.11","lessThan":"5.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/relocation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0bc25f0a2d1b3e0a691431c4d7aef36afcd527c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29531470b1bf1e8bd2df4941fe913106edbca615","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/415f8665a969d3c906e4fd7c90fcbb4b357886f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63d6b1f04cd91c825329712aa526215ffa5d11ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab48583aa9948205ff9a6470e23dbff74c565e24","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b78fe9563e2d5ae47805f1e5dc722c91fd30e1f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee695a968aa73b1e67ccbf2133dc0e54381d32b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93799","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.720","lastModified":"2026-10-03T11:17:49.483","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: validate sta_id in BA window status notif\n\nBA_WINDOW_STATUS_NOTIFICATION_ID extracts a 5-bit sta_id from the\nfirmware notification and uses it to index fw_id_to_mac_id[] without\nbounds checking. Validate sta_id before array access to prevent\nout-of-bounds indexing."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3af512d6aac7eb6420086f124abb4426f5f4b369","lessThan":"f9938eb95e2ddab4a58d3946a320abcbd60b56a4","versionType":"git","status":"affected"},{"version":"3af512d6aac7eb6420086f124abb4426f5f4b369","lessThan":"bb08fbbbd5568d33069485ecb0a1657f115a4e9f","versionType":"git","status":"affected"},{"version":"3af512d6aac7eb6420086f124abb4426f5f4b369","lessThan":"e35ae757c6462bfd3437bf58121bb721fe1f790c","versionType":"git","status":"affected"},{"version":"3af512d6aac7eb6420086f124abb4426f5f4b369","lessThan":"6aa77efaea9efea92e3090c35ad348fd759a3cf3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/6aa77efaea9efea92e3090c35ad348fd759a3cf3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb08fbbbd5568d33069485ecb0a1657f115a4e9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e35ae757c6462bfd3437bf58121bb721fe1f790c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f9938eb95e2ddab4a58d3946a320abcbd60b56a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93800","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:12.870","lastModified":"2026-10-03T11:17:49.673","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()\n\nIf during relocation we fail in insert_dirty_subvol() because\nbtrfs_update_reloc_root() returned an error, we will leave a root's\nreloc_root field pointing to a reloc root that was freed instead of NULL,\nresulting later in a use-after-free, or double free attempt during\nunmount.\n\nThe sequence of steps is this:\n\n1) During relocation the call to btrfs_update_reloc_root() in\n   insert_dirty_subvol() fails, so insert_dirty_subvol() returns the\n   error to merge_reloc_root() without adding the root to the list\n   rc->dirty_subvol_roots;\n\n2) Then merge_reloc_root() aborts the current transaction because\n   insert_dirty_subvol() returned an error;\n\n3) Up the call chain, merge_reloc_roots() gets the error, adds the\n   reloc root for root X to the local reloc_roots list and jumps to the\n   'out' label, where it calls free_reloc_roots() to free all the reloc\n   roots in the local reloc_roots list. This frees the reloc root for\n   root X;\n\n4) We go up the call chain to relocate_block_group() which calls\n   clean_dirty_subvols() to go over dirty roots and set their\n   ->reloc_root field to NULL, but root X is not in the dirty_subvol_roots\n   list, so its ->reloc_root still points to a reloc root;\n\n5) Relocation finishes, with an error and a transaction abort, but the\n   ->reloc_root field for root X still points to the reloc root that was\n   freed in step 3;\n\n6) When unmounting the fs we end up calling:\n\n     btrfs_free_fs_roots()\n        btrfs_drop_and_free_fs_root()\n           --> calls btrfs_put_root() against root X's ->reloc_root\n               which is not NULL and points to the already freed\n               reloc root in step 4 above\n\n  Resulting in a use-after-free to a double free attempt.\n\nSyzbot reported this with the following dmesg/syslog:\n\n   [  106.004389][ T5339] BTRFS error (device loop0 state A): Transaction aborted (error -5)\n   [  106.014266][ T5339] BTRFS: error (device loop0 state A) in merge_reloc_root:1655: errno=-5 IO failure\n   [  106.021891][ T1061] BTRFS error (device loop0 state A): error while writing out transaction: -5\n   [  106.026964][ T1061] BTRFS warning (device loop0 state A): Skipping commit of aborted transaction.\n   [  106.033807][ T5340] BTRFS error (device loop0 state A): bdev /dev/loop0 errs: wr 3, rd 0, flush 0, corrupt 0, gen 0\n   [  106.039265][ T1061] BTRFS: error (device loop0 state A) in cleanup_transaction:2067: errno=-5 IO failure\n   [  106.044382][ T5339] BTRFS info (device loop0 state EA): forced readonly\n   [  106.074329][ T5339] BTRFS: error (device loop0 state EA) in merge_reloc_roots:1887: errno=-5 IO failure\n   [  106.081004][ T5356] BTRFS info (device loop0 state EA): scrub: started on devid 1\n   [  106.085611][ T5339] BTRFS info (device loop0 state EA): balance: ended with status: -30\n   [  106.089517][ T5356] BTRFS info (device loop0 state EA): scrub: not finished on devid 1 with status: -30\n   [  106.662365][ T5338] BTRFS info (device loop0 state EA): last unmount of filesystem 3a375e4e-b156-4d76-a2ad-16e198ce1409\n   [  106.682946][ T5338] ==================================================================\n   [  106.686574][ T5338] BUG: KASAN: slab-use-after-free in btrfs_put_root+0x2f/0x250\n   [  106.690090][ T5338] Write of size 4 at addr ffff88803f978630 by task syz.0.0/5338\n   [  106.693173][ T5338]\n   [  106.694279][ T5338] CPU: 0 UID: 0 PID: 5338 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)\n   [  106.694293][ T5338] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n   [  106.694300][ T5338] Call Trace:\n   [  106.694308][ T5338]  <TASK>\n   [  106.694314][ T5338]  dump_stack_lvl+0xe8/0x150\n   [  106.694331][ T5338]  print_address_description+0x55/0x1e0\n   [  106.694343][ T5338]  ? btrfs_put_root+0x2f/0x250\n   [  106.694358][ T5338]  print_report+0x58/0x70\n   [  106.\n---truncated---"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/relocation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f32b84d7c977e1906a4781b93b3c93090b6cd675","lessThan":"5a247097c5f94b51ffc991b444d998ad6e85875f","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"6372dd394ea907cd85a7a8063db320ec73dfaed0","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"9f599d120b2b79d2d937c3935b7cdf2697514283","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"a01837ae174a2a968c245a30e6dd010f50eaf05d","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"97a540d72ebcb21853d11f2a56782fe377f358e7","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"fda1b6636ff1846f00643e791099db5564b547d9","versionType":"git","status":"affected"},{"version":"592fbcd50c99b8adf999a2a54f9245caff333139","lessThan":"83201804efa4a5168be754e1dfc9b2faee760cac","versionType":"git","status":"affected"},{"version":"aa18bc1ff8a51f082d5b3b6d07693797637b4028","versionType":"git","status":"affected"},{"version":"4cb0aea2e250eee35ccfac5f5395cd8f3238a9e5","versionType":"git","status":"affected"},{"version":"5.10.36","lessThan":"5.10.271","versionType":"semver","status":"affected"},{"version":"5.11.20","lessThan":"5.12","versionType":"semver","status":"affected"},{"version":"5.12.3","lessThan":"5.13","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/relocation.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5a247097c5f94b51ffc991b444d998ad6e85875f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6372dd394ea907cd85a7a8063db320ec73dfaed0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83201804efa4a5168be754e1dfc9b2faee760cac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97a540d72ebcb21853d11f2a56782fe377f358e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f599d120b2b79d2d937c3935b7cdf2697514283","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a01837ae174a2a968c245a30e6dd010f50eaf05d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fda1b6636ff1846f00643e791099db5564b547d9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93801","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.017","lastModified":"2026-10-21T13:21:08.140","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb/client: zero-initialize stack-allocated cifs_open_info_data\n\nStack-allocated cifs_open_info_data may contain random data.\nThis can make some fields have wrong value if they are not set later."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/link.c","fs/smb/client/smb1ops.c","fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"436cfdbc57d98808fce427d9a8d97691374989b3","lessThan":"2c5db82778f560121efda9e052e2f19c2d807c1b","versionType":"git","status":"affected"},{"version":"fc2f2011d3d84b56f536b4a25a4bb2fa1b13d520","lessThan":"74ff47e6c4213fcfeba2de448d9cbda200507d22","versionType":"git","status":"affected"},{"version":"057ac50638bcece64b3b436d3a61b70ed6c01a34","lessThan":"22532dd88694ed20bdd47523ffa709f166ce776b","versionType":"git","status":"affected"},{"version":"057ac50638bcece64b3b436d3a61b70ed6c01a34","lessThan":"8fce4cf4369c766a3293a05419500cbfde72e60d","versionType":"git","status":"affected"},{"version":"83d3bc866530a36a465b47cce4d2a9def2411960","versionType":"git","status":"affected"},{"version":"6.6.113","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.12.54","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.17.4","lessThan":"6.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/link.c","fs/smb/client/smb1ops.c","fs/smb/client/smb2ops.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/22532dd88694ed20bdd47523ffa709f166ce776b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c5db82778f560121efda9e052e2f19c2d807c1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74ff47e6c4213fcfeba2de448d9cbda200507d22","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fce4cf4369c766a3293a05419500cbfde72e60d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93802","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.127","lastModified":"2026-10-03T11:17:49.843","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: validate beacon length before fixed buffer copy\n\nrsi_prepare_beacon() copies the mac80211 beacon frame after\nFRAME_DESC_SZ into a management skb whose usable tailroom may be smaller\nthan MAX_MGMT_PKT_SIZE after alignment.\n\nValidate the beacon length against the actual tailroom before the copy\nand skb_put(). Leave ownership of the management skb with the caller on\nerror, matching the existing rsi_send_beacon() cleanup path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/rsi/rsi_91x_hal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"795ba65f46fe44061f1195951c122cc8ec685d44","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"66a964432b2758a4cf69962366e37581d6e70632","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"7f99742c3c2801f8033d8b7a0a58254d7f24fb1e","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"f08d7f3c916335a0e539f1c45c130615967fac47","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"87710ad633ce4588aec88611d0d0745eb33a6991","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"266f195d5a14eec6c482fd09fbc924584c3371a7","versionType":"git","status":"affected"},{"version":"d26a9559403c7c3ec3b430f5825bc22c3d40abdb","lessThan":"8ecdeb8b8a33b22c597299043c0dcfce50beb9ea","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/rsi/rsi_91x_hal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.14","status":"affected"},{"version":"0","lessThan":"4.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/266f195d5a14eec6c482fd09fbc924584c3371a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66a964432b2758a4cf69962366e37581d6e70632","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/795ba65f46fe44061f1195951c122cc8ec685d44","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f99742c3c2801f8033d8b7a0a58254d7f24fb1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87710ad633ce4588aec88611d0d0745eb33a6991","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ecdeb8b8a33b22c597299043c0dcfce50beb9ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f08d7f3c916335a0e539f1c45c130615967fac47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93803","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.240","lastModified":"2026-10-03T11:17:50.060","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: libipw: fix key index receive bound checks\n\nlibipw_rx() reads skb->data[hdrlen + 3] to extract the WEP key index in\nboth the software-decrypt key selection path and the hardware-decrypted\nIV/ICV strip path. In both places the existing guard only checks\nskb->len >= hdrlen + 3, which proves bytes up to hdrlen + 2 but not the\nbyte at hdrlen + 3.\n\nRequire hdrlen + 4 bytes before reading that item in both paths. This is\na local source-boundary check only; it does not change the key index\nsemantics."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"bb18262c19feb690ddde58c70e3ad04bc6fe566e","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"2836a870f612a8a6d9e390d00fa2cf6c90aa5808","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"0b61c465ea62063593bc9ac186871b69e58ae991","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"062840bdc9ee06169b3c371bf66711f1d7ec0bf4","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"c54b643e9a0936d038921c547736574fd7382cea","versionType":"git","status":"affected"},{"version":"b453872c35cfcbdbf5a794737817f7d4e7b1b579","lessThan":"74ed3669f26803b1761c1f55403062bea44c3466","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/ipw2x00/libipw_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.14","status":"affected"},{"version":"0","lessThan":"2.6.14","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/062840bdc9ee06169b3c371bf66711f1d7ec0bf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/09d4a1bc3a08bb0e19bdf250b9f575cfef0bae82","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0b61c465ea62063593bc9ac186871b69e58ae991","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2836a870f612a8a6d9e390d00fa2cf6c90aa5808","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74ed3669f26803b1761c1f55403062bea44c3466","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb18262c19feb690ddde58c70e3ad04bc6fe566e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c54b643e9a0936d038921c547736574fd7382cea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93804","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.350","lastModified":"2026-10-21T13:21:08.277","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: ibss: wait for in-flight TX on disconnect\n\nWhile leaving an IBSS in ieee80211_ibss_disconnect() mac80211 flushes\nstations, turns the carrier off and immediately tells the driver to\nleave as well. While there may be synchronize_net() in station flush\nand in this code later, packets can still be transmitted due to\ncross-CPU race conditions after carrier off is set.\nTherefore, it's possible for a race to happen where a TX to the\ndriver occurs while or after telling it to leave the IBSS. This can\nbe confusing to drivers, and in the case of iwlwifi leads to an\nattempt to use invalid queues.\n\nMove netif_carrier_off() to occur before sta_info_flush() during\nIBSS disconnect, and add synchronize_net() if flushing didn't,\nso that the synchronize_net() always happens between turning the\ncarrier off and telling the driver, avoiding this race."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/ibss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"86a2ea4134b48f6371103cfceb521bf2d2bf76cd","lessThan":"8e4a07ed82bae5d13525770880dc6dfd27f9bccd","versionType":"git","status":"affected"},{"version":"86a2ea4134b48f6371103cfceb521bf2d2bf76cd","lessThan":"20a3fb5e1a95caa34896853ca17a50d21c754969","versionType":"git","status":"affected"},{"version":"86a2ea4134b48f6371103cfceb521bf2d2bf76cd","lessThan":"b3451e6971248250312ad32dd7f63cc9f0a925f5","versionType":"git","status":"affected"},{"version":"86a2ea4134b48f6371103cfceb521bf2d2bf76cd","lessThan":"d0e69d9afa59b93c30294eba89b1f15f69e91105","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/ibss.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.3","status":"affected"},{"version":"0","lessThan":"3.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20a3fb5e1a95caa34896853ca17a50d21c754969","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8e4a07ed82bae5d13525770880dc6dfd27f9bccd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3451e6971248250312ad32dd7f63cc9f0a925f5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0e69d9afa59b93c30294eba89b1f15f69e91105","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93805","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.460","lastModified":"2026-10-03T11:17:50.190","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate rx/tx MLME callback frame lengths before access\n\ncfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() call tracepoints\nbefore rejecting frames shorter than the frame-control field. After\nthat, they only require len >= 2 before dispatching into subtype\nhandlers that assume their fixed fields are present.\n\nThe frames that trip this are not shorter than 2 bytes; they are short\nrelative to their subtype. mwifiex is a concrete in-tree example on the\nlength side: mwifiex_process_mgmt_packet() only requires a 4-address\nieee80211_hdr plus the 2-byte firmware length prefix before handing the\nframe to cfg80211_rx_mlme_mgmt(). After stripping the length prefix and\nremoving addr4, pkt_len can be exactly 24: a bare 3-address management\nheader with no reason-code body. The existing WARN_ON(len < 2) does not\nfire on such a frame, and cfg80211_process_deauth() then reads\nu.deauth.reason_code as a two-byte access starting at offset 24,\nimmediately past the 24-byte buffer.\n\nAdd a frame-control length gate, then validate each subtype's minimum\nframe size in an if/else-if chain that mirrors the dispatch logic. Trace\nonly after the frame is known to be well-formed.\n\nSide effects of this change:\n - The WARN_ON(len < 2) is dropped. It only guarded the frame_control\n   read, never the subtype fixed fields, and it does not fire on the\n   frames that actually trigger the out-of-bounds read (which are >= 2).\n   The len >= 2 check is kept as the guard before dereferencing\n   frame_control, but without the warning: these are exported callbacks\n   and a malformed frame from a driver should be dropped silently rather\n   than backtraced.\n - cfg80211_tx_mlme_mgmt() previously routed every non-deauth subtype\n   through disassociation handling; it now silently ignores unrecognised\n   subtypes."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"ce2a3be6909462f49c34de96be71f0ad5f0d573f","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"6bdf4dcff98df634e04ebf99f52027a48d7f78ff","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"0ec738a0d361d7eb37188117166d201f9df622d3","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"8f4127a93cf60d561ad39849a9ac763ba0e14db5","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"d5e4586546974179feca305a94e07fac3e9727fe","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0ec738a0d361d7eb37188117166d201f9df622d3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bdf4dcff98df634e04ebf99f52027a48d7f78ff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6eb4bd50be53f5afbabb3a3b5153276e08fa7a4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f4127a93cf60d561ad39849a9ac763ba0e14db5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ce2a3be6909462f49c34de96be71f0ad5f0d573f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5e4586546974179feca305a94e07fac3e9727fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93806","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.570","lastModified":"2026-10-03T11:17:50.320","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: validate assoc response length before status and IE access\n\ncfg80211_rx_assoc_resp() initialises the status and response-IE fields\nof cfg80211_connect_resp_params from the management frame before\nproving that the frame is long enough for those offsets. S1G and\nregular association responses also have different IE offsets, but the\nS1G path only patched resp_ie after the unsafe initialiser had already\nrun.\n\nDefer resp_ie, resp_ie_len, and status to after the link-iteration\nloop. Use a bool to remember whether the frame is S1G, then validate\nthe appropriate minimum length and set all three fields in a single\nif/else block. Funnel short-frame and SME-reject cleanup through a\nshared free_bss label for the abandon paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"3bcaaaa4ad334053ceea2ea2f0623f22afe2e1ac","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"71be658246c903b9e96976a23c23800675896a1b","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"a57310600c1e2b9ada0f37c96e8f48aef47d3093","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"78ac450ad4624d6b2999cb4eeb28916767f81247","versionType":"git","status":"affected"},{"version":"6829c878ecd24ff0ae41b4668c7e9d0f11b66942","lessThan":"b760113aeca2e9362d56bf9e9263373ffe6c8eb3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/mlme.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3bcaaaa4ad334053ceea2ea2f0623f22afe2e1ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/71be658246c903b9e96976a23c23800675896a1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78ac450ad4624d6b2999cb4eeb28916767f81247","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a57310600c1e2b9ada0f37c96e8f48aef47d3093","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b760113aeca2e9362d56bf9e9263373ffe6c8eb3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93807","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.683","lastModified":"2026-10-03T11:17:50.480","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers\n\nrsi_hal_load_key() copies tx_mic_key and rx_mic_key from data[16] and\ndata[24] whenever key data is present. Those offsets are only part of\nthe 32-byte TKIP key layout. Shorter keys used by other ciphers, such as\nCCMP, do not provide those bytes, so the unconditional copies can read\npast the supplied key buffer.\n\nOnly copy the MIC keys for TKIP, and reject malformed TKIP keys that are\nshorter than the expected 32-byte layout.\n\n[drop useless length check]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/rsi/rsi_91x_mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"6937b06d55b528e961feff8cc083b97ede622e02","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"ebd7172f8c4edc232738ef50338fb773c6f6c208","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"6b6690ac5c35e803df14afdc44312d11e8a60893","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"5207727e53fba1e3a6fce9b2c15b6b8b06c6438b","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"5902e3c08c63d65724772f74d65b9fb032625dca","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"55b86ef6c2e68879ffd95203b011ef42a013ab88","versionType":"git","status":"affected"},{"version":"dad0d04fa7ba41ce603a01e8e64967650303e9a2","lessThan":"843fe9bc583b7686ca68312ac9319c9240a73c03","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/rsi/rsi_91x_mgmt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.15","status":"affected"},{"version":"0","lessThan":"3.15","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5207727e53fba1e3a6fce9b2c15b6b8b06c6438b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55b86ef6c2e68879ffd95203b011ef42a013ab88","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5902e3c08c63d65724772f74d65b9fb032625dca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6937b06d55b528e961feff8cc083b97ede622e02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b6690ac5c35e803df14afdc44312d11e8a60893","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/843fe9bc583b7686ca68312ac9319c9240a73c03","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebd7172f8c4edc232738ef50338fb773c6f6c208","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93808","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.797","lastModified":"2026-10-03T11:17:50.603","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: caiaq: validate EP1 reply lengths\n\nusb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then\nreads command-specific fixed items from the same URB buffer. Several\npaths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that\nurb->actual_length contains those bytes.\n\nAdd per-command length checks, use a payload length derived from the\nbytes after the command byte for the control-state copy, and reject short\nanalog input payloads before the input helper reads fixed offsets from\nthe EP1 reply."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/usb/caiaq/device.c","sound/usb/caiaq/input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"91acd231f219452fa58285239f83945accad9513","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"7cc6b3745a0cea697c8d0684b3094f220281a08d","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"add9328c91c195c494cd68a21b19e5e47a20d784","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"319393151367e6626affedcdd4f7b7b0286f4246","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"af8a172c4f71ac30d625f2966d2389a7fa872819","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"74f3c639f64fa5da4e1613149798b5089bce2807","versionType":"git","status":"affected"},{"version":"523f1dce37434a9a6623bf46e7893e2b4b10ac3c","lessThan":"aba30af07d4fe499b50209801eba9da8a815522f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/usb/caiaq/device.c","sound/usb/caiaq/input.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","lessThan":"2.6.22","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/319393151367e6626affedcdd4f7b7b0286f4246","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74f3c639f64fa5da4e1613149798b5089bce2807","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cc6b3745a0cea697c8d0684b3094f220281a08d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91acd231f219452fa58285239f83945accad9513","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aba30af07d4fe499b50209801eba9da8a815522f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/add9328c91c195c494cd68a21b19e5e47a20d784","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af8a172c4f71ac30d625f2966d2389a7fa872819","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93809","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:13.917","lastModified":"2026-09-25T13:17:21.763","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: flush pending RCU callbacks on module unload\n\nCall rcu_barrier() in module exit to wait for outstanding call_rcu() callbacks\nbefore freeing module text, preventing late callback execution in freed memory.\n\nBUG: unable to handle page fault for address: ffffffffc1d59c40\nPGD 6a12067 P4D 6a12067 PUD 6a14067 PMD 13698b067 PTE 0\nOops: 0010 [#1] SMP NOPTI\nRIP: 0010:0xffffffffc1d59c40\nCode: Unable to access opcode bytes at RIP 0xffffffffc1d59c16.\nRSP: 0018:ffffc900198c0f28 EFLAGS: 00010286\nRAX: ffffffffc1d59c40 RBX: ffff897c7d6b61c0 RCX: ffff88826aff4590\nRDX: ffff8884d8b35490 RSI: ffffc900198c0f30 RDI: ffff88812af67290\nRBP: 000000000000000a (DONE segment entries) R08: 0000000000000000 R09: 0000000000000100\nR10: 0000000000000000 R11: ffffffff82a06100 R12: ffff88811a4e3700\nR13: 0000000000000000 R14: ffff897c7d6b6270 R15: 0000000000000000\nFS:  0000000000000000(0000) GS:ffff897c7d680000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffffffc1d59c16 CR3: 00000104a980a001 CR4: 0000000002770ee0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400\nPKRU: 55555554\nCall Trace:\n <IRQ>\n ? rcu_do_batch+0x163/0x450\n ? rcu_core+0x177/0x1c0\n ? __do_softirq+0xc1/0x280\n ? asm_call_irq_on_stack+0xf/0x20\n </IRQ>\n ? do_softirq_own_stack+0x37/0x50\n ? irq_exit_rcu+0xc4/0x100\n ? sysvec_apic_timer_interrupt+0x36/0x80\n ? asm_sysvec_apic_timer_interrupt+0x12/0x20\n ? cpuidle_enter_state+0xd4/0x360\n ? cpuidle_enter+0x29/0x40\n ? cpuidle_idle_call+0x108/0x1a0\n ? do_idle+0x77/0xf0\n ? cpu_startup_entry+0x19/0x20\n ? secondary_startup_64_no_verify+0xbf/0xcb\n\n(cherry picked from commit feaa5039f6c12acc9aa934c2d45dcd251a12c69f)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4e02e0afa95f691dc7cc17538cdd648089a843f0","lessThan":"67a654b41cfa73c3b83402c4a01b2689cad5b9bc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/67a654b41cfa73c3b83402c4a01b2689cad5b9bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93810","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.433","lastModified":"2026-10-03T11:17:50.733","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncachefiles: Fix double fput\n\nFix a double fput() in error handling in cachefiles_create_tmpfile()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/cachefiles/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"e582a3e99584d5a634a3cbce4b12e9381fd5d964","versionType":"git","status":"affected"},{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"246098a2b8e88761e92cf82c1be1ec576437b176","versionType":"git","status":"affected"},{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"e9c2e68c3890a935abbd5f54dbce653f9a16836c","versionType":"git","status":"affected"},{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"90b306eee037d0a6a8f4aac834b46e05c5ddd0bf","versionType":"git","status":"affected"},{"version":"24a81759b65fa85767739999d91523691c5e2ea5","lessThan":"af6830cc12dfe86c832dccc9c9878a93aaa22f83","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/cachefiles/namei.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/246098a2b8e88761e92cf82c1be1ec576437b176","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90b306eee037d0a6a8f4aac834b46e05c5ddd0bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/af6830cc12dfe86c832dccc9c9878a93aaa22f83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e582a3e99584d5a634a3cbce4b12e9381fd5d964","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9c2e68c3890a935abbd5f54dbce653f9a16836c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93811","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.550","lastModified":"2026-10-03T11:17:50.870","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling\n\n1. When ndr_decode_v4_ntacl() fails, the code jumped to free_n_data\n   which only freed n.data, skipping kfree(acl.sd_buf) and leaking\n   the buffer. Zero-initialize struct xattr_ntacl acl, reorder error\n   labels to out_free to release acl.sd_buf on all error paths.\n\n2. if (acl.sd_size < sizeof(struct smb_ntsd)) is true, original code\n   returned success without freeing sd_buf and left stale *pntsd.\n   Set rc = -EINVAL before jumping to out_free to return error code and\n   free buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb69d4d6f709f87c94afa28ae64c501576692171","lessThan":"f46a70a082bdbfecbe074af8a719c26c4deb58c6","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"86c2625fb9863139b359805fc6be1e31edbd3d65","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"edc17db83085624a2b1bacf6a4521d7f15571737","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"c3836f55e0dab96314774215e12d87f63fa919f2","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"6e6329322ad733c5b23555c609353841560b26bc","versionType":"git","status":"affected"},{"version":"8f0541186e9ad1b62accc9519cc2b7a7240272a7","lessThan":"d708a36634bb7b6f94d0e76d587d2ec50b2b93b5","versionType":"git","status":"affected"},{"version":"6e8f4abf584253cbaa596ea4ad13110cf61cd4c9","versionType":"git","status":"affected"},{"version":"8e33102309bd6839b2e2e158f93a7b378cb4655d","versionType":"git","status":"affected"},{"version":"5.15.62","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"5.18.18","lessThan":"5.19","versionType":"semver","status":"affected"},{"version":"5.19.2","lessThan":"5.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.0","status":"affected"},{"version":"0","lessThan":"6.0","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6e6329322ad733c5b23555c609353841560b26bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/86c2625fb9863139b359805fc6be1e31edbd3d65","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3836f55e0dab96314774215e12d87f63fa919f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d708a36634bb7b6f94d0e76d587d2ec50b2b93b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/edc17db83085624a2b1bacf6a4521d7f15571737","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f46a70a082bdbfecbe074af8a719c26c4deb58c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93812","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.657","lastModified":"2026-10-03T11:17:50.993","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr\n\nndr_encode_v4_ntacl() allocates sd_ndr.data via kzalloc() at entry.\nIf any subsequent ndr_write_*() call returns error during encoding,\nthe allocated sd_ndr.data won't be freed and causes memory leak.\n\nMove kfree(sd_ndr.data) into out label to ensure the buffer gets\nreleased on all success and error return paths."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"306d6f370da7e0e5532dc51c972f4ce101e42431","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"dc55270e410ccb4d24e637c13b5c4c25bcd106d7","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"9b4dec75498fd0a1c9eaea680aef59c9519eb16f","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"c521dd78e036b5e0cfd394dd2ff2218890dd9e41","versionType":"git","status":"affected"},{"version":"303fff2b8c77a85c62dbde3b27c24b084144c04c","lessThan":"d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/server/vfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/306d6f370da7e0e5532dc51c972f4ce101e42431","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b4dec75498fd0a1c9eaea680aef59c9519eb16f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c521dd78e036b5e0cfd394dd2ff2218890dd9e41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c866c3314a6853eb06c7a8bef67f43c8a8bdfb6e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4d56b00c7df88cd5751e7415bdfabc9fdbc82a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc55270e410ccb4d24e637c13b5c4c25bcd106d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93813","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.763","lastModified":"2026-10-03T11:17:51.120","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tree-checker: validate INODE_REF's namelen\n\n[BUG]\nA crafted btrfs image can trigger the following crash:\n\n  BUG: unable to handle page fault for address: ffffd1dc42884000\n  #PF: supervisor write access in kernel mode\n  #PF: error_code(0x0002) - not-present page\n  CPU: 9 UID: 0 PID: 1034 Comm: poc Not tainted 7.1.0-rc4-custom+ #383 PREEMPT(full)  46af0a92938a63be7132e0dfd71e62327c51d5c2\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:memcpy+0xc/0x10\n  Call Trace:\n   <TASK>\n   read_extent_buffer+0xe4/0x100 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f]\n   btrfs_get_name+0x15e/0x1e0 [btrfs 3cf0785dd58fec8c5ff84633b772f17ce1f92a8f]\n   reconnect_path+0x165/0x390\n   exportfs_decode_fh_raw+0x337/0x400\n   ? drop_caches_sysctl_handler+0xb0/0xb0\n   </TASK>\n  ---[ end trace 0000000000000000 ]---\n  RIP: 0010:memcpy+0xc/0x10\n  Kernel panic - not syncing: Fatal exception\n\n[CAUSE]\nTThe crafted image has the following corrupted INODE_REF item:\n\n         item 9 key (258 INODE_REF 257) itemoff 11544 itemsize 4106\n         \tindex 2 namelen 4096 name: d\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\\000\n\nThe itemsize matches the namelen, but the namelen is 4096, way larger\nthan normal name length limit (BTRFS_NAME_LEN, 255).\n\nMeanwhile the memory of the @name is only 255 byte sized, this will cause\nout-of-boundary access, and cause the above crash.\n\n[FIX]\nAdd extra namelen verification for INODE_REF, just like what we have\ndone in ROOT_REF checks.\n\nNow the crafted image can be rejected gracefully:\n\n BTRFS critical (device dm-2): corrupt leaf: root=5 block=30572544 slot=14 ino=259, invalid inode ref name length, has 4096 expect [1, 255]\n BTRFS error (device dm-2): read time tree block corruption detected on logical 30572544 mirror 2\n\n[ Rebase, add a Link: tag, add an simple cause analyze ]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/tree-checker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"60078a3e25c09d9d8fba828b0d81bb33e449a1b2","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"509d6a4d889e425f305461d8323a7b39ca6c121c","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"4cb41f07685f88ec724a375883bb0c731db8f6eb","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"eeddee090b834a7d4b6a8214d2e3739e64c7a338","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"8f75c19892263bc0555fba922aefe103e841e86d","versionType":"git","status":"affected"},{"version":"2ede0daf01549cecf4bb0962c46dc47382047523","lessThan":"3dc22abc21f5892406c09202fa2627196cc96967","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/tree-checker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3dc22abc21f5892406c09202fa2627196cc96967","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cb41f07685f88ec724a375883bb0c731db8f6eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/509d6a4d889e425f305461d8323a7b39ca6c121c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60078a3e25c09d9d8fba828b0d81bb33e449a1b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f75c19892263bc0555fba922aefe103e841e86d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eeddee090b834a7d4b6a8214d2e3739e64c7a338","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93814","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:14.897","lastModified":"2026-10-03T11:17:51.293","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: core: Abort active target transfer on controller suspend\n\nWhen an SPI controller operating in target mode has a transfer in\nprogress at the time of system suspend, the suspend path proceeds\nwithout aborting the ongoing transfer. This can leave the hardware in\nan inconsistent state, potentially causing the system to hang or fail\nto resume cleanly.\n\nFix this by invoking the controller's target_abort callback from\nspi_controller_suspend() when the controller is in target mode and the\ncallback is registered. This ensures any active target transfer is\ncleanly terminated before the controller is suspended."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"a75d9eb78c89d3fa8d503966c91a51f02eced768","versionType":"git","status":"affected"},{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"1cc84ca8599b8fa64014821bca453ebb3326c71e","versionType":"git","status":"affected"},{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"b81ac605763c319ca9928a237818ab4e8ab7bb59","versionType":"git","status":"affected"},{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"f6a0cafa265c8a4aed585d873747e3b88b146eed","versionType":"git","status":"affected"},{"version":"6c364062bfed3c34490e85bea52ff6e2d4f0f281","lessThan":"c1bab046d4786c5b17aab7c5225bf0d4a2a2d19b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.13","status":"affected"},{"version":"0","lessThan":"4.13","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1cc84ca8599b8fa64014821bca453ebb3326c71e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a75d9eb78c89d3fa8d503966c91a51f02eced768","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b81ac605763c319ca9928a237818ab4e8ab7bb59","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1bab046d4786c5b17aab7c5225bf0d4a2a2d19b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6a0cafa265c8a4aed585d873747e3b88b146eed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93815","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.010","lastModified":"2026-10-03T11:17:51.403","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: au1000: move free_irq out of the close-time spinlocked section\n\nau1000_close() calls free_irq() while aup->lock is still held with\nspin_lock_irqsave(). free_irq() can sleep because it takes the IRQ\ndescriptor request mutex, so it does not belong inside the close-time\nspinlocked section.\n\nThis was found by our static analysis tool and then confirmed by manual\nreview of the in-tree au1000_close() .ndo_stop path. The reviewed path\nkeeps aup->lock held across the MAC reset, queue stop and\nfree_irq(dev->irq, dev).\n\nA directed runtime validation kept that ndo_stop carrier and the same\nfree_irq(dev->irq, dev) operation under the driver lock. Lockdep reported\n\"BUG: sleeping function called from invalid context\" and \"Invalid wait\ncontext\" while free_irq() was taking desc->request_mutex, with\nau1000_close() and free_irq() on the stack.\n\nDrop aup->lock before freeing the IRQ. The protected close-time work still\nstops the device and queue before IRQ teardown, but the sleepable IRQ core\npath now runs outside the spinlocked section."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/amd/au1000_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f86bca5b7857b85bfa8afdb4fa895d7c0a3f7ebc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"26fd652915123a690f19d62b253b545a53f3cd51","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d514b08ed61fdffe23604fd3e9e53c07cbe5ac3e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e1b5a13249975fec3cf654efa84f57118db2da2c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4536667fba8ddbaff2f2a135080ae6aabf737b5e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fc2233f1ab2a1ca562869bca6987d7477671388c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f48763beab4eea41fc480c9702ec6eebe8d75e4f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/amd/au1000_eth.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/26fd652915123a690f19d62b253b545a53f3cd51","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4536667fba8ddbaff2f2a135080ae6aabf737b5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d514b08ed61fdffe23604fd3e9e53c07cbe5ac3e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e1b5a13249975fec3cf654efa84f57118db2da2c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f48763beab4eea41fc480c9702ec6eebe8d75e4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f86bca5b7857b85bfa8afdb4fa895d7c0a3f7ebc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc2233f1ab2a1ca562869bca6987d7477671388c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93816","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.120","lastModified":"2026-10-03T11:17:51.527","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: validate inline dentry name lengths before conversion\n\nInline dentry conversion copies names out of the inline dentry area\nbefore checking that each recorded name length fits in the available\nfilename slots.\n\nA corrupted image can therefore make the conversion path read past\nthe inline filename storage while building the regular dentry block.\n\nValidate each inline dentry name length against the inline filename\narea before copying it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/f2fs/inline.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"6b5552449fc5acb8e6ecf045b46702b29b71165a","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"6343208fd73f3f2b8044c0922185cd13ff807693","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"4dd81faa63fd54b9ba1a83c304e6d0bd03f1898d","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"aee4e6de71ca77626c006166ff00f1d01ff990c9","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"2ce0bc5853bec7cdc724477a87ea579fde664243","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"7caa8a0ae94b132576c2e46e9b4fd4e0f356f373","versionType":"git","status":"affected"},{"version":"675f10bde6cc3874632a8f684df2a8a2a8ace76e","lessThan":"cfcd0e49a178b3dac2c0ece656079081dbf5da74","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/f2fs/inline.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/2ce0bc5853bec7cdc724477a87ea579fde664243","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4dd81faa63fd54b9ba1a83c304e6d0bd03f1898d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6343208fd73f3f2b8044c0922185cd13ff807693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b5552449fc5acb8e6ecf045b46702b29b71165a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7caa8a0ae94b132576c2e46e9b4fd4e0f356f373","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aee4e6de71ca77626c006166ff00f1d01ff990c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfcd0e49a178b3dac2c0ece656079081dbf5da74","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93817","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.233","lastModified":"2026-10-21T13:21:08.397","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix addr_filter_ranges lifetime\n\nLee Jia Jie reported that since event::addr_filter_ranges is used\nunder RCU, it should be RCU freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"375637bc524952f1122ea22caf5a8f1fecad8228","lessThan":"1d8e1e99b063de4179cc8af14d08115d74a37abf","versionType":"git","status":"affected"},{"version":"375637bc524952f1122ea22caf5a8f1fecad8228","lessThan":"cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1","versionType":"git","status":"affected"},{"version":"375637bc524952f1122ea22caf5a8f1fecad8228","lessThan":"6f1853b2b9f38f1343790bae8c0601b3f7554754","versionType":"git","status":"affected"},{"version":"375637bc524952f1122ea22caf5a8f1fecad8228","lessThan":"e62d4192e593630f355094adc467058a05bdc935","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/events/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1d8e1e99b063de4179cc8af14d08115d74a37abf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f1853b2b9f38f1343790bae8c0601b3f7554754","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e62d4192e593630f355094adc467058a05bdc935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93818","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.350","lastModified":"2026-09-25T13:17:22.683","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: plda: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/plda/pcie-plda-host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76c9113968079140cb2f885631db422170f32105","lessThan":"105f212a21cc6bef6855841216dd476022626170","versionType":"git","status":"affected"},{"version":"76c9113968079140cb2f885631db422170f32105","lessThan":"cb78a1d7a2787758a2d8e1182c346d4349f43260","versionType":"git","status":"affected"},{"version":"76c9113968079140cb2f885631db422170f32105","lessThan":"4e4f9745f016c1631d00a4035b06f6e75d449e01","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/plda/pcie-plda-host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/105f212a21cc6bef6855841216dd476022626170","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e4f9745f016c1631d00a4035b06f6e75d449e01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cb78a1d7a2787758a2d8e1182c346d4349f43260","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93819","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.467","lastModified":"2026-10-03T11:17:51.670","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: mediatek: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/pcie-mediatek.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"d54417acb22d9e8bc404a8598330bc9729ee7146","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"5dd379acfa38c516e904bcfa693502cd585a0bba","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"8d910649725955435c6a807944108bca0570712d","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"31e33dcc896527b3ad790fdc6aa6b8d2995c078b","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"c57b971765f835138fa2fce3f2a171b004cbb114","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"a568939487dcbc1a3e341208585e224be897e25e","versionType":"git","status":"affected"},{"version":"031337ace2d1c22a447da6390716fe92592cdd6e","lessThan":"a29812a55da8d0dbeb071b26ac428c338e3fc389","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/pcie-mediatek.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/31e33dcc896527b3ad790fdc6aa6b8d2995c078b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5dd379acfa38c516e904bcfa693502cd585a0bba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8d910649725955435c6a807944108bca0570712d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a29812a55da8d0dbeb071b26ac428c338e3fc389","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a568939487dcbc1a3e341208585e224be897e25e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c57b971765f835138fa2fce3f2a171b004cbb114","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d54417acb22d9e8bc404a8598330bc9729ee7146","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93820","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.573","lastModified":"2026-10-03T11:17:51.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: rockchip: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/pcie-rockchip-host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"025308e7c9cd10112b73558c9f63f8f7285fa726","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"ac47d42901859edb504a2890a3a5709c86dbc0c3","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"eaeb9bed3641741aceb0add84a97023bed61e748","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"5d566ac3a055f0a6f4890ff0af7cfd7e8ed89652","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"ebca7e5947720e9d4bd918af3e17720270c50744","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"9b19201f57d87c4d0777621275dbc59bff41b7f2","versionType":"git","status":"affected"},{"version":"073d3dbe9a7c38888d8dafe09df421b174a6cffa","lessThan":"0bd9611587bb494c33566d825fe34b2705e4b167","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/pcie-rockchip-host.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/025308e7c9cd10112b73558c9f63f8f7285fa726","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0bd9611587bb494c33566d825fe34b2705e4b167","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d566ac3a055f0a6f4890ff0af7cfd7e8ed89652","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b19201f57d87c4d0777621275dbc59bff41b7f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac47d42901859edb504a2890a3a5709c86dbc0c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eaeb9bed3641741aceb0add84a97023bed61e748","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ebca7e5947720e9d4bd918af3e17720270c50744","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93821","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.690","lastModified":"2026-10-03T11:17:51.897","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: altera: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/pcie-altera.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"cf9d84d1b6a7c3f3780c043df220a7e9e38137eb","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"fc462f1bdeaea9789928cbfdf5e069ee559c7642","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"442b7f2a093b4a75f8963aaa7cbb2b8df35a6ac3","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"4b69c63cc247fc0f499fbd11076fee9c2a6e6fd7","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"c0cd65906e5f7e293ef2568c9524cc0a918333c3","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"7cbb8f2750d91e64caff89e164ac8280bb80bedc","versionType":"git","status":"affected"},{"version":"ec15c4d0d5d2e431169fbdf6c6bcf0c8ff71ef22","lessThan":"a8759c8ac48c0419f5899e95a6ffc611b07c965b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/pcie-altera.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/442b7f2a093b4a75f8963aaa7cbb2b8df35a6ac3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4b69c63cc247fc0f499fbd11076fee9c2a6e6fd7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cbb8f2750d91e64caff89e164ac8280bb80bedc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8759c8ac48c0419f5899e95a6ffc611b07c965b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c0cd65906e5f7e293ef2568c9524cc0a918333c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf9d84d1b6a7c3f3780c043df220a7e9e38137eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc462f1bdeaea9789928cbfdf5e069ee559c7642","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93822","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.813","lastModified":"2026-10-03T11:17:52.010","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI: iproc: Protect root bus removal with rescan lock\n\nHold the pci_rescan_remove_lock lock while stopping and removing a root bus\nto avoid racing with concurrent rescan or hotplug operations triggered via\nsysfs.  Such races may lead to use-after-free issues or system crashes.\n\n[bhelgaas: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/controller/pcie-iproc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"e7d9d7be2c1f8d434032983bc86a05805178c9c9","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"1618e374ba4c7117c04662422ef985e9d64e2466","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"4e1d34d824050a4e700ca442f815a95d9f214b83","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"aaf4153caed9f1760b9f266612b0599bfd97150c","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"bd2bf1e0d973c93fc1637b90cbb9a5a5f6884bd3","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"ee06aafc2d760a4ee023e0b2e95ce1ec71bddc6c","versionType":"git","status":"affected"},{"version":"1fb37a8178da007cad75f48e2355b9dcb0711e06","lessThan":"a6a64e150f12ad5391e0a0d60f6a3d119b06ce50","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/controller/pcie-iproc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.1","status":"affected"},{"version":"0","lessThan":"4.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1618e374ba4c7117c04662422ef985e9d64e2466","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4e1d34d824050a4e700ca442f815a95d9f214b83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6a64e150f12ad5391e0a0d60f6a3d119b06ce50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aaf4153caed9f1760b9f266612b0599bfd97150c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd2bf1e0d973c93fc1637b90cbb9a5a5f6884bd3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e7d9d7be2c1f8d434032983bc86a05805178c9c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee06aafc2d760a4ee023e0b2e95ce1ec71bddc6c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93823","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:15.947","lastModified":"2026-10-03T11:17:52.120","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Let driver decide buffer size at AMDKFD_IOC_GET_DMABUF_INFO ioctl\n\namdkfd driver needs allocate buffer to return bo metadata to user space. The\nbuffer size is controlled by user currently. It is a potential security issue\nthat hostile value (e.g. 2 GiB) lets any render-group user trigger order-MAX\nallocation/OOM in kernel context.\n\nThis patch first finds bo metadata size. If the size is smaller than user\nprovided value drive can safely allocate buffer in kernel space and copy to\nuser space buffer. If not, driver will let user know, not allocate and copy.\nUser will redo with new buffer in user space.\n\nThis patch lets driver decide buffer allocation size to avoid potential hostile\nsize from user space.\n\n(cherry picked from commit f54ce9e8cbd3abe0eda3a285f54dc4f572fe589a)"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c","drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h","drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1dde0ea95b782425b95455d487cb44991525a1d1","lessThan":"d51841bb5ceee75ec3aeeb4e5c51c8e5e7524228","versionType":"git","status":"affected"},{"version":"1dde0ea95b782425b95455d487cb44991525a1d1","lessThan":"a65ccabde6deb95baf9442bd98299e2248884162","versionType":"git","status":"affected"},{"version":"1dde0ea95b782425b95455d487cb44991525a1d1","lessThan":"2d9fd0f01550aab4a0a1984b4379e50545906248","versionType":"git","status":"affected"},{"version":"1dde0ea95b782425b95455d487cb44991525a1d1","lessThan":"8242a8d9d7194d5ef8a8b38a5621ca0966a3ec15","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c","drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h","drivers/gpu/drm/amd/amdkfd/kfd_chardev.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.0","status":"affected"},{"version":"0","lessThan":"5.0","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2d9fd0f01550aab4a0a1984b4379e50545906248","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8242a8d9d7194d5ef8a8b38a5621ca0966a3ec15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a65ccabde6deb95baf9442bd98299e2248884162","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d51841bb5ceee75ec3aeeb4e5c51c8e5e7524228","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93824","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.073","lastModified":"2026-10-03T11:17:52.223","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: reject the combination of TLS and sockmap\n\nTLS and sockmap (BPF psock) integration hides a lot of latent bugs.\nBugs which may be more or less relevant for real users but they\nare definitely exploitable.\n\nWe could not find anyone actively using this integration so let's\nreject this config. Adding a TLS socket to a sockmap was already\nrejected by sk_psock_init() through the inet_csk_has_ulp() check.\nWe need to reject the attempts to configure the TLS keys (rather\nthan adding the ULP itself) because checking prior to the ULP\ninstallation is tricky without risking a race with sockmap getting\nadded in parallel (sockmap does not hold the socket lock).\n\nThis patch is a minimal rejection of the feature. Subsequent patch\nin the series will do a light dead code removal. Full cleanup would\nrequire a major rewrite of the Tx path, we don't need skmsg any more."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/tls/tls_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"c4896592744f30ff026f799947c5978bcfd7c8c7","versionType":"git","status":"affected"},{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"e26aa709454d48c3b3ef8d3100c8a04e7d9fd94e","versionType":"git","status":"affected"},{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"c3d4d537337f69e405a36fa561e7292ee4148bf7","versionType":"git","status":"affected"},{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"a08e780b6cc1153cbff8be55de9ec9da809e344f","versionType":"git","status":"affected"},{"version":"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca","lessThan":"460e6486617c17dd19abe8f3fc67d9a6fa25f8ca","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/tls/tls_main.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/460e6486617c17dd19abe8f3fc67d9a6fa25f8ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a08e780b6cc1153cbff8be55de9ec9da809e344f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3d4d537337f69e405a36fa561e7292ee4148bf7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4896592744f30ff026f799947c5978bcfd7c8c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e26aa709454d48c3b3ef8d3100c8a04e7d9fd94e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93825","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.193","lastModified":"2026-10-03T11:17:52.330","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: Add NULL check for spi_get_device_id() in spi_get_device_match_data()\n\nPrevent NULL pointer dereference when spi_get_device_id() returns NULL,\nwhich can happen when using driver_override without matching SPI ID entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bd1be85dbbbd4076e8dbdceefc3c4d2c673e0075","lessThan":"1fa4484116d14a0356edfeb6ecc7ea3b370911b1","versionType":"git","status":"affected"},{"version":"027eaeaf3294607104e90e84cec3f55e792cab22","lessThan":"aa966ccea3584a70c9a6030f4a16577030db35e5","versionType":"git","status":"affected"},{"version":"aea672d054a21782ed8450c75febb6ba3c208ca4","lessThan":"359b3442e66c595ed03e5a6b0493b66600c63941","versionType":"git","status":"affected"},{"version":"aea672d054a21782ed8450c75febb6ba3c208ca4","lessThan":"3fcd9415144f4fbd21e1bef35a7f8dbd734f607d","versionType":"git","status":"affected"},{"version":"aea672d054a21782ed8450c75febb6ba3c208ca4","lessThan":"72cc9c6d6fba5b4e0aaf89126884a56bb54b92f8","versionType":"git","status":"affected"},{"version":"aea672d054a21782ed8450c75febb6ba3c208ca4","lessThan":"f1b061b4d4c6cbf861319ba954caa80145cf018f","versionType":"git","status":"affected"},{"version":"5.15.146","lessThan":"5.15.222","versionType":"semver","status":"affected"},{"version":"6.1.71","lessThan":"6.1.189","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1fa4484116d14a0356edfeb6ecc7ea3b370911b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/359b3442e66c595ed03e5a6b0493b66600c63941","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fcd9415144f4fbd21e1bef35a7f8dbd734f607d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72cc9c6d6fba5b4e0aaf89126884a56bb54b92f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa966ccea3584a70c9a6030f4a16577030db35e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f1b061b4d4c6cbf861319ba954caa80145cf018f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93826","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.297","lastModified":"2026-10-03T11:17:52.437","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hidpp: fix potential UAF in hidpp_connect_event()\n\nIf input_register_device() fails, we call input_free_device(), but keep\nstale pointer to the old device in hidpp->input, which could potentially\nlead to UAF. Fix that by resetting it to NULL before returning from\nhidpp_connect_event()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hid/hid-logitech-hidpp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"e03fd646adad7f97fa4429ec5f38cee9bde5276e","versionType":"git","status":"affected"},{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"5d7637f4d050d105177217e64b869f56f9825060","versionType":"git","status":"affected"},{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"3b8b2e58b078cd30e121401535541bb8a6d57133","versionType":"git","status":"affected"},{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"3303398cc2aa255ba251650a30024e11d48ea6c3","versionType":"git","status":"affected"},{"version":"c39e3d5fc9dd3e16c6f59dd94d827540040de66d","lessThan":"6df6b1f2c49678211f65647c300bc51dda02893b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hid/hid-logitech-hidpp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.19","status":"affected"},{"version":"0","lessThan":"3.19","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/3303398cc2aa255ba251650a30024e11d48ea6c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b8b2e58b078cd30e121401535541bb8a6d57133","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d7637f4d050d105177217e64b869f56f9825060","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6df6b1f2c49678211f65647c300bc51dda02893b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e03fd646adad7f97fa4429ec5f38cee9bde5276e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93827","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.410","lastModified":"2026-09-25T13:17:23.513","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-fs: avoid double-free on failed queue setup\n\nvirtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling\nvirtio_find_vqs(). If virtio_find_vqs() fails, the error path frees both\npointers and returns an error to virtio_fs_probe().\n\nvirtio_fs_probe() then drops the last kobject reference, and\nvirtio_fs_ktype_release() frees fs->vqs and fs->mq_map again. This leaves\ndangling pointers in struct virtio_fs and can trigger a double-free during\nprobe failure cleanup.\n\nSet fs->vqs and fs->mq_map to NULL immediately after kfree() in the\nvirtio_fs_setup_vqs() error path so that the later kobject release sees an\nuninitialized state and kfree(NULL) becomes harmless.\n\nThis can be reproduced when a broken virtio-fs device advertises more\nrequest queues than the transport actually provides. In that case\nvirtio_find_vqs() fails while setting up the extra queue, and the probe\npath reaches the double-free cleanup sequence."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/fuse/virtio_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad","versionType":"git","status":"affected"},{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"20ef4739b329bb09cff11dd2458795a50674658e","versionType":"git","status":"affected"},{"version":"a8f62f50b4e4ea92a938fca2ec1bd108d7f210e9","lessThan":"6af3330ec5d5fb8c06c04eb520a71cf73ea5a765","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/fuse/virtio_fs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.9","status":"affected"},{"version":"0","lessThan":"6.9","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/20ef4739b329bb09cff11dd2458795a50674658e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fbc5ee776fefbc6ea34d2518f1f5f90aa2e1dad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6af3330ec5d5fb8c06c04eb520a71cf73ea5a765","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93828","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.517","lastModified":"2026-10-21T13:21:08.547","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nexfat: fix handling of damaged volume in exfat_create_upcase_table()\n\nWhen the size of the upcase table is set to zero in the dentry for any\nreason(e.g. corrupted media or misbehaving device), an integer overflow\ncauses the module to loop indefinitely.\n\nIf the size of the upcase table is read zero, do not attempt to load the\ntable. Instead, fallback to loading the default upcase table. If the\nsize of the upcase table is zero or no upcase table is found, raise\nexfat_fs_error() to mark the volume read-only."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/exfat/nls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"370e812b3ec190fa492c9fd5a80c38b086d105c0","lessThan":"29723256fccf46e55c2a44bd6b8345bef7ba079b","versionType":"git","status":"affected"},{"version":"370e812b3ec190fa492c9fd5a80c38b086d105c0","lessThan":"60ace93811609e4dd883e9de5fb4462ed834160a","versionType":"git","status":"affected"},{"version":"370e812b3ec190fa492c9fd5a80c38b086d105c0","lessThan":"2cc0b612343638057ef321ce735201a7c2f52f25","versionType":"git","status":"affected"},{"version":"370e812b3ec190fa492c9fd5a80c38b086d105c0","lessThan":"20dd3185d13865214ff25b0bf7b931e8d73be1ac","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/exfat/nls.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/20dd3185d13865214ff25b0bf7b931e8d73be1ac","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29723256fccf46e55c2a44bd6b8345bef7ba079b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2cc0b612343638057ef321ce735201a7c2f52f25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60ace93811609e4dd883e9de5fb4462ed834160a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93829","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.630","lastModified":"2026-10-03T11:17:52.570","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix races in cifsd thread creation\n\nThe cifsd demultiplex thread can run and access tcp_ses before the parent\nthread has finished populating tcp_ses, which the worker thread accesses\nlocklessly.\n\nAlso, the kthread_run macro may start the thread before returning the\nthread pointer. Because the pointer is part of the structure that the\nthread can access, if the kernel is preempted after the thread is spawned,\nbut before the thread pointer is populated and the thread attempts to exit,\nit will sleep, waiting for a SIGKILL signal.\n\nFix this by moving creation of the thread to after all of tcp_ses'es\nfields are populated, and spawning the thread last, using a split\nkthread_create/wake_up_process logic."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aaf737adb6937339494d5a7111f0433cd9676db8","lessThan":"cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5","versionType":"git","status":"affected"},{"version":"aaf737adb6937339494d5a7111f0433cd9676db8","lessThan":"ee8f811cbac56ffb738b3a73671a9e75b0f56e99","versionType":"git","status":"affected"},{"version":"aaf737adb6937339494d5a7111f0433cd9676db8","lessThan":"0eee1e6cddd1d9ce14da06e0238ca8d3362dec90","versionType":"git","status":"affected"},{"version":"aaf737adb6937339494d5a7111f0433cd9676db8","lessThan":"e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/smb/client/connect.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","lessThan":"2.6.22","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0eee1e6cddd1d9ce14da06e0238ca8d3362dec90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfa09f63e75cf440c9be97d1e73d509bfbb2c2c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e8a5cf2ff5a13fefb228f2069e29dd7d8e37185d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee8f811cbac56ffb738b3a73671a9e75b0f56e99","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-93830","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:16.740","lastModified":"2026-10-03T11:17:52.673","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: xgmac2: disable RBUE in default RX interrupt mask\n\nEnabling the RX Buffer Unavailable (RBUE) interrupt is counterproductive\nand can trigger a MAC interrupt storm under heavy RX pressure. When the\nDMA runs out of RX descriptors it fires RBUE continuously until software\nrefills the ring.\n\nHowever, RBUE is redundant: the normal RX completion interrupt (RIE)\nalready triggers NAPI, which processes completed descriptors and refills\nthe ring, causing the DMA to resume. The RBUE handler itself only sets\nhandle_rx - the same outcome as RIE.\n\nOn Agilex5 under heavy RX pressure, the MAC interrupt (which includes\nRBUE) was observed firing 1,821,811,555 times against only 2,618,627\nactual RX completions - a ~695x ratio - confirming the severity of the\nstorm.\n\nRBUE does not provide OOM recovery. If page_pool is exhausted,\nstmmac_rx_refill() cannot advance the DMA tail pointer, the DMA stays\nsuspended, and RBUE fires again on the next NAPI completion - a storm\nwith no forward progress. This patch trades that storm for a clean\nstall with the same RX outcome. Proper OOM recovery is a pre-existing\ngap outside the scope of this fix.\n\nNote: as a consequence of disabling RBUE, the rx_buf_unav_irq ethtool\ncounter will always read 0 on XGMAC2 devices. This behaviour is already\ninconsistent across DWMAC core versions.\n\nRemove RBUE from XGMAC_DMA_INT_DEFAULT_EN and XGMAC_DMA_INT_DEFAULT_RX\nto prevent the interrupt storm while keeping normal RX handling intact."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"8c9d57b5dc098b84631d0b3559c84c499ea2170a","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"7a10e54e42a8f73a8d731f5a281fc06bb41b9250","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"6b3b91433d5f4eae6865cdaa96f40cd67849e1f6","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"87e2826ed2058747ddf014c082569a46bfadd96b","versionType":"git","status":"affected"},{"version":"d6ddfacd95c79d43465d4a85dffb1c9beca343a9","lessThan":"d3265c19b35d036bba327b36b5366bee76b0157c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/stmicro/stmmac/dwxgmac2.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.19","status":"affected"},{"version":"0","lessThan":"4.19","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/0b1a5d3647ce07c27a9fffefc11a8cbf7d7b25ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b3b91433d5f4eae6865cdaa96f40cd67849e1f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74dbb85a6a254b5fc1f265a6cd61b2ba9d9221d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a10e54e42a8f73a8d731f5a281fc06bb41b9250","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87e2826ed2058747ddf014c082569a46bfadd96b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c9d57b5dc098b84631d0b3559c84c499ea2170a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3265c19b35d036bba327b36b5366bee76b0157c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-94281","sourceIdentifier":"meissner@suse.de","published":"2026-09-24T17:17:16.860","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client."}],"affected":[{"source":"meissner@suse.de","affectedData":[{"vendor":"x.org","product":"libXi","defaultStatus":"unaffected","packageName":"libXi","repo":"https://gitlab.freedesktop.org/xorg/lib/libxi","versions":[{"version":"0","lessThan":"1.8.4","versionType":"rpm","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"meissner@suse.de","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:14:08.828973Z","id":"CVE-2026-94281","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"meissner@suse.de","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://gitlab.freedesktop.org/xorg/lib/libxi/-/merge_requests/23/diffs?commit_id=605f419d013153bf9e026cd100752ffbe930f3c1","source":"meissner@suse.de"}]}},{"cve":{"id":"CVE-2026-94604","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:16.987","lastModified":"2026-09-24T17:17:16.987","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE is a duplicate of another CVE."}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-94606","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.063","lastModified":"2026-10-05T16:17:17.863","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an authentication or enrollment flow accepts a recipient address supplied in the setup request instead of using the address already established by the flow. An actor who knows a target user's password can substitute an attacker-controlled address, receive the one-time code, and finish enrolling the factor as the target. The target must not have enrolled the email factor already. Successful enrollment gives the actor a session as the target and access to single sign-on applications behind the account. Other authenticator types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","baseScore":8.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:53:08.106815Z","id":"CVE-2026-94606","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-807"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/01d4349f2aaa9beda532f92e2a251a17fefee9b3","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/1fcf9868133e5d05e266edbc1f6f3ee972baa3f9","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/c10ae83ebf8c61de2f1922edf1fab504d9f3b06f","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/ec41732339726fba477182c0906a8d930b145beb","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25958","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25963","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25968","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25973","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-qgqp-xh8r-v73r","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-94609","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.230","lastModified":"2026-09-28T16:17:18.200","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate those privileges. Group hierarchy checks do not consistently account for superuser status inherited from ancestor groups, and role assignment to a group lacks the required authorization check. Only deployments that delegate these management capabilities to accounts that are not full administrators are affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:41:43.925095Z","id":"CVE-2026-94609","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/5f95b86f6f70c3bd8c625a4f9ae474e235f84030","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/67317f66f1b7eb16f2a26bf550dfd73699d49d87","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/67e470dde8c81a40ee27ec6e178462368c561a60","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/898e4e4fa070642a3541a376af0de64fe3ffeb67","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25956","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25961","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25966","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25971","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-h6c5-mpvq-j4jc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-94611","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.390","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, applications using a client or shared secret, and applications using a proxy provider. Deployments are affected when view permission is granted to accounts that are not intended to read these credentials; deployments where every viewer is permitted to read them are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:07:45.172270Z","id":"CVE-2026-94611","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/4b3fad38be44ef3eef1f0baf83e7b3061229eb99","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/5109a4d4998d6a5ee399ca3e22ba546231c140c7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/6bed64ef80a4dd21011cce64c41b1e7c5640ecb3","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/77d2e24442c3eb6e88010f40aa569a8bfb584f99","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25955","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25960","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25965","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25970","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-m9h4-7j9c-55x9","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-94612","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.557","lastModified":"2026-09-24T19:39:45.600","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an authentik SAML Source verifies an assertion's signature and validity period but does not ensure that the identity provider issued the assertion for that Source or in response to a login request from that Source. The SAML Source also does not record already accepted assertions, allowing replay. An unauthenticated actor who possesses such a valid assertion can use an assertion intended for another service provider or reuse an earlier assertion to authenticate as the user named by the assertion. Only SAML Sources are affected; SAML Providers and other Source types are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:15:17.274740Z","id":"CVE-2026-94612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/287ea13cdc23c378abc20a7b71c9c7919a19a89a","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/355d8cc3d755fbba05fc5fa90ffbcbe6469acddd","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/54fac864a0b3bc00551af1908f662b3bf5cc6135","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/984b0162711f0d1988ed33544d0a671c93e4ec76","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25957","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25962","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25967","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25972","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-cqj8-fxxf-9pg7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-94613","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T17:17:17.723","lastModified":"2026-09-29T03:17:21.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"goauthentik","product":"authentik","versions":[{"version":"< 2026.2.7","status":"affected"},{"version":">= 2026.5.0, < 2026.5.7","status":"affected"},{"version":">= 2026.8.0, < 2026.8.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:53:11.993694Z","id":"CVE-2026-94613","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://docs.goauthentik.io/releases/2026.2#fixed-in-202627","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.5#fixed-in-202657","source":"security-advisories@github.com"},{"url":"https://docs.goauthentik.io/releases/2026.8#fixed-in-202682","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/03d19d63b8d8dd7bc3de7cf6e57c6df341a9fc86","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/4cf2f803b1c2ef38c224eead375fd057a10ee8ac","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/732adad26bb97361b6bf25ef138df5c16471ba1f","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/commit/a029f5372295bfeb1e334855f78601681cdc9a2d","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25959","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25964","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25969","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/pull/25974","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.2.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.5.7","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/releases/tag/version/2026.8.2","source":"security-advisories@github.com"},{"url":"https://github.com/goauthentik/authentik/security/advisories/GHSA-cxwx-9x59-28qm","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-97231","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T17:17:18.033","lastModified":"2026-09-29T03:17:22.940","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"volotat","product":"Anagnorisis","cpes":["cpe:2.3:a:volotat:anagnorisis:*:*:*:*:*:*:*:*"],"modules":["Socket.IO Connect Interface"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.3.0","status":"affected"},{"version":"0.3.1","status":"affected"},{"version":"0.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:55:29.885134Z","id":"CVE-2026-97231","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://note-hxlab.wetolink.com/share/y74Vzt1jfkAi","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97231","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908265","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409321","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409321/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97407","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.203","lastModified":"2026-10-03T11:17:52.820","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt\n\nrockchip_pdm_set_fmt() calls pm_runtime_get_sync() before accessing\nhardware registers, but ignores its return value.\nIf the runtime resume fails, the function continues to perform register\naccesses while the device state is undefined.\nReplace pm_runtime_get_sync() with pm_runtime_resume_and_get() and\nreturn early on failure to avoid unpowered register accesses."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/rockchip/rockchip_pdm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"105ea8b7a29b473cbe3aa1e542997700c98e3adc","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"aa48db0257ed4cdb52f922d32872dcc8d201925e","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"52b77346cf66174ab9bc34504729cd686a9e29b1","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"7f0fd754c708785c31b067dd98649e3ec9b8fd72","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"a9cc27a4a9b5fe013e152841fd8408061fa2312f","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"b2b5c2ca5a4924271fa86d75a252de32fa285375","versionType":"git","status":"affected"},{"version":"c85064435fe7a216ec0f0238ef2b8f7cd850a450","lessThan":"ee7b5f7b39332febf917f9ebf212842cc9379815","versionType":"git","status":"affected"},{"version":"a8f82720673d41b85145f232c954fe3a365f72b5","versionType":"git","status":"affected"},{"version":"88294658ddbe0e35fa48e1679252e86b3b5ba1d2","versionType":"git","status":"affected"},{"version":"2f0ec100032e9f23b7561ec6f3b5c8a9806a7100","versionType":"git","status":"affected"},{"version":"4.14.118","lessThan":"4.15","versionType":"semver","status":"affected"},{"version":"4.19.42","lessThan":"4.20","versionType":"semver","status":"affected"},{"version":"5.0.15","lessThan":"5.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/rockchip/rockchip_pdm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.1","status":"affected"},{"version":"0","lessThan":"5.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/105ea8b7a29b473cbe3aa1e542997700c98e3adc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/52b77346cf66174ab9bc34504729cd686a9e29b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f0fd754c708785c31b067dd98649e3ec9b8fd72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9cc27a4a9b5fe013e152841fd8408061fa2312f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa48db0257ed4cdb52f922d32872dcc8d201925e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2b5c2ca5a4924271fa86d75a252de32fa285375","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee7b5f7b39332febf917f9ebf212842cc9379815","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97408","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.337","lastModified":"2026-10-03T11:17:52.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: validate connectionless PSM length\n\nConnectionless L2CAP frames carry a two-byte PSM at the start of the\npayload.  l2cap_recv_frame() currently reads that PSM unconditionally\nafter validating only the outer L2CAP length.\n\nA malformed connectionless frame with a zero- or one-byte payload can\ntherefore make the parser read beyond the advertised skb payload and use\ntailroom bytes as part of the PSM.  A VHCI-backed QEMU reproducer\ninjected a one-byte connectionless payload and reached the unchecked\nread.\n\nReject connectionless frames that cannot contain the PSM before reading\nor pulling it.  This preserves all valid connectionless frames while\ndropping only structurally incomplete packets."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8104cd9859b6de0826cffa68adf2c1461185823b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"22fc1ce4e37c81d4e7aac01566ebdc232214540d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"72e26293a231f63a856340d3a1f0f5fc29bf87e5","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3502ede8aed3c3ee1786d952a11054ac737d1a38","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ae69dca122f6d6046a68cf40153e6e827c77ff5c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a40a5f922546b3bd7c094d882b29177db4f2abe0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/l2cap_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/22fc1ce4e37c81d4e7aac01566ebdc232214540d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3502ede8aed3c3ee1786d952a11054ac737d1a38","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72e26293a231f63a856340d3a1f0f5fc29bf87e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8104cd9859b6de0826cffa68adf2c1461185823b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9448e6f693fcf1f0ac4ee648a9b2cc83bfe4a982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a40a5f922546b3bd7c094d882b29177db4f2abe0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae69dca122f6d6046a68cf40153e6e827c77ff5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97409","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.463","lastModified":"2026-10-03T11:17:53.063","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: Do not cancel requests in io target before it is initialized\n\nA new nvme-fc controller in CONNECTING state sees admin request timeout\nschedules ctrl->ioerr_work to abort inflight requests. This ends up\ncalling __nvme_fc_abort_outstanding_ios() which aborts requests in both\nadmin and io tagsets. In case fc_ctrl->tag_set was not initialized we\nsee the warning below. This is because ctrl.queue_count is initialized\nearly in nvme_fc_alloc_ctrl().\n\nnvme nvme0: NVME-FC{0}: starting error recovery Connectivity Loss\nINFO: trying to register non-static key.\nThe code is fine but needs lockdep annotation, or maybe\nlpfc 0000:ab:00.0: queue 0 connect admin queue failed (-6).\nyou didn't initialize this object before use?\nturning off the locking correctness validator.\nWorkqueue: nvme-reset-wq nvme_fc_ctrl_ioerr_work [nvme_fc]\nCall Trace:\n <TASK>\n dump_stack_lvl+0x57/0x80\n register_lock_class+0x567/0x580\n __lock_acquire+0x330/0xb90\n lock_acquire.part.0+0xad/0x210\n blk_mq_tagset_busy_iter+0xf9/0xc00\n __nvme_fc_abort_outstanding_ios+0x23f/0x320 [nvme_fc]\n nvme_fc_ctrl_ioerr_work+0x172/0x210 [nvme_fc]\n process_one_work+0x82c/0x1450\n worker_thread+0x5ee/0xfd0\n kthread+0x3a0/0x750\n ret_from_fork+0x439/0x670\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nUpdate the check in __nvme_fc_abort_outstanding_ios() confirm that io\ntagset was created before iterating over busy requests. Also make sure\nto cancel ctrl->ioerr_work before removing io tagset."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/host/fc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"52793d62a696e9188092eb0817fb1219ee5729ff","lessThan":"5488e2706c58444a24e15773237dcc0bedcd771f","versionType":"git","status":"affected"},{"version":"52793d62a696e9188092eb0817fb1219ee5729ff","lessThan":"da930308b4bc24c335574e85ca84ff70a988cf05","versionType":"git","status":"affected"},{"version":"52793d62a696e9188092eb0817fb1219ee5729ff","lessThan":"dd39064d2948b14dbe4f364fe4b3c9cfc632cc21","versionType":"git","status":"affected"},{"version":"52793d62a696e9188092eb0817fb1219ee5729ff","lessThan":"ee38469f88492df99e1d97f03aa40ecfd218934f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/host/fc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/5488e2706c58444a24e15773237dcc0bedcd771f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da930308b4bc24c335574e85ca84ff70a988cf05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd39064d2948b14dbe4f364fe4b3c9cfc632cc21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee38469f88492df99e1d97f03aa40ecfd218934f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97410","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.600","lastModified":"2026-09-25T13:17:24.553","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetconsole: take target_cleanup_list_lock in drop_netconsole_target()\n\ndrop_netconsole_target() unlinks the target while only holding\ntarget_list_lock. However, when the underlying interface has been\nunregistered, netconsole_netdev_event() moves the target from\ntarget_list to target_cleanup_list, and netconsole_process_cleanups_core()\nwalks that list under target_cleanup_list_lock only.\n\nIf a user removes the configfs target at the same time the cleanup\nworker is iterating target_cleanup_list, list_del() can corrupt the list\nbecause the two paths take disjoint locks while operating on the same\nlist node.\n\nAcquire target_cleanup_list_lock around the list_del() so the unlink is\nserialised against netconsole_process_cleanups_core() regardless of\nwhich list the target currently belongs to. The state transition that\ndowngrades STATE_DEACTIVATED to STATE_DISABLED is left intact and is\nperformed under the same combined locking, preserving the existing\nordering with resume_target()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/netconsole.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"97714695ef904a4bdba75ca2f339215c0ae2b1fa","lessThan":"84592ee22f7d1583ce33aa733411ff36c7a1c44c","versionType":"git","status":"affected"},{"version":"97714695ef904a4bdba75ca2f339215c0ae2b1fa","lessThan":"fe8e6c0a2f28bdab14cdf7eff4dd9755d3793007","versionType":"git","status":"affected"},{"version":"97714695ef904a4bdba75ca2f339215c0ae2b1fa","lessThan":"91aeb87f052367a5a2743cc93777dfb4386f2f14","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/netconsole.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/84592ee22f7d1583ce33aa733411ff36c7a1c44c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91aeb87f052367a5a2743cc93777dfb4386f2f14","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe8e6c0a2f28bdab14cdf7eff4dd9755d3793007","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97411","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.720","lastModified":"2026-10-03T11:17:53.200","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ibm: emac: mal: fix potential system hang in mal_remove()\n\nnapi_disable() is not idempotent and calling it on an already-disabled\nor unenabled NAPI context will cause the kernel to spin indefinitely\nwaiting for the NAPI_STATE_SCHED bit to clear.\n\nIn mal_remove(), napi_disable() is called unconditionally. If no MACs were\nregistered, NAPI was never enabled. Also, if they were registered but\nsubsequently unregistered, NAPI was already disabled in\nmal_unregister_commac(). In either case, calling napi_disable() causes\nthe kernel to hang upon module removal.\n\nFix this by only calling napi_disable() in mal_remove() if the commac list\nis not empty (which implies NAPI is enabled)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/ibm/emac/mal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"9c1c814a662d9c81959eba591bb52b24639390f2","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"34c4cae51718d6f393415e01c61314c1bde02f2e","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"62126e73e230cf4bd6c27cf201949c4290af84a1","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"f0399b3e212741bc5a64b8399d6266c4a150bdfe","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"f6c1aad9b35fa083f48ce0c5926204891d82e089","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"c4cb9a728df66c46067b26263f5beb633aae4087","versionType":"git","status":"affected"},{"version":"b3e441c6ed8655a42e7b4da1b6dc7939f259d9c9","lessThan":"7c5d41f87f079990bf241359e3c1332d8d10fe87","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/ibm/emac/mal.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.24","status":"affected"},{"version":"0","lessThan":"2.6.24","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/34c4cae51718d6f393415e01c61314c1bde02f2e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/62126e73e230cf4bd6c27cf201949c4290af84a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c5d41f87f079990bf241359e3c1332d8d10fe87","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c1c814a662d9c81959eba591bb52b24639390f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4cb9a728df66c46067b26263f5beb633aae4087","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f0399b3e212741bc5a64b8399d6266c4a150bdfe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f6c1aad9b35fa083f48ce0c5926204891d82e089","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97412","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.847","lastModified":"2026-10-21T13:21:09.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: quiesce DMA before freeing resources\n\npdsc_teardown() frees DMA buffers but does not disable bus mastering,\nleaving the device able to perform DMA after the buffers are freed.\nThis can lead to use-after-free if the device writes to freed memory.\n\nAdd pci_clear_master() to pdsc_teardown() to disable bus mastering\nbefore freeing resources, ensuring all DMA is quiesced.\n\nAdd pci_set_master() to pdsc_setup() to re-enable bus mastering,\nwhich is needed for the firmware recovery path since pdsc_teardown()\nnow disables it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/amd/pds_core/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"45d76f492938cdc27ddadc16e1e75103f4cfbf56","lessThan":"84fc3f30b87e06a11d1807cd385603522610ed40","versionType":"git","status":"affected"},{"version":"45d76f492938cdc27ddadc16e1e75103f4cfbf56","lessThan":"cc8beb70e70fc90e54efdbc1128cf7de799e6be4","versionType":"git","status":"affected"},{"version":"45d76f492938cdc27ddadc16e1e75103f4cfbf56","lessThan":"9eee6b90bee3df496ed9094d9e76d5e478d72d0a","versionType":"git","status":"affected"},{"version":"45d76f492938cdc27ddadc16e1e75103f4cfbf56","lessThan":"6443f4f20bdae726fe01cf5946fba9742a0ffda6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/amd/pds_core/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/6443f4f20bdae726fe01cf5946fba9742a0ffda6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/84fc3f30b87e06a11d1807cd385603522610ed40","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9eee6b90bee3df496ed9094d9e76d5e478d72d0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cc8beb70e70fc90e54efdbc1128cf7de799e6be4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97413","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:18.990","lastModified":"2026-10-03T11:17:53.320","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs-srv: Fix integer underflow in process_read and process_write\n\nusr_len is read from a network-supplied message field (le16_to_cpu)\nand used to compute data_len = off - usr_len without validating that\nusr_len <= off. A malicious RDMA client can send usr_len > off causing\nan integer underflow, resulting in data_len wrapping to a huge size_t\nvalue which is then passed to the rdma_ev callback as a memory length,\nleading to out-of-bounds memory access.\n\nFix by reading and validating usr_len <= off before rtrs_srv_get_ops_ids()\nin both process_read() and process_write(), ensuring the early return\npath acquires no reference and has no resource leak."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-srv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"6b1e26e70d7ca9f0906af2283558a530eeb1f066","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"2c52b2afded988233cd4ccc185cf5147bbc77a76","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"b042b4947752df0b3d16e683ac09fb4f7f0e33e0","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"24ad03bfeda05fca04c56677e57fd3d6bc3e9978","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"c76e9123ab91a903396d26e6ab1b5caae5c6b149","versionType":"git","status":"affected"},{"version":"9cb837480424e78ed585376f944088246685aec3","lessThan":"54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/ulp/rtrs/rtrs-srv.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/24ad03bfeda05fca04c56677e57fd3d6bc3e9978","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2c52b2afded988233cd4ccc185cf5147bbc77a76","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/54bf38b27afc08a0eb6b732f9c14eb8a4bcb66b5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b1e26e70d7ca9f0906af2283558a530eeb1f066","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b042b4947752df0b3d16e683ac09fb4f7f0e33e0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c76e9123ab91a903396d26e6ab1b5caae5c6b149","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97414","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.103","lastModified":"2026-09-25T13:17:24.943","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: mt8365-afe-pcm: fix possible NULL-pointer dereferences in mt8365_afe_suspend()\n\nmt8365_afe_suspend() allocates the register backup buffer with\ndevm_kcalloc(), but does not check for allocation failure before using the\nreturned pointer. This may lead to a NULL pointer dereference when\naccessing afe->reg_back_up[i].\n\nAdd the missing NULL check and return -ENOMEM on allocation failure after\ndisabling the main clock.\n\nAlso propagate the return value of mt8365_afe_suspend() in\nmt8365_afe_dev_runtime_suspend() so that the suspended state is not updated\nwhen suspend fails."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/soc/mediatek/mt8365/mt8365-afe-pcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e1991d102bc2abb32331c462f8f3e77059c69578","lessThan":"f87707bc0406fe92bc142a9eee5f480c94ce9ff8","versionType":"git","status":"affected"},{"version":"e1991d102bc2abb32331c462f8f3e77059c69578","lessThan":"1094d83ad325829acd68e63147793536060a0d60","versionType":"git","status":"affected"},{"version":"e1991d102bc2abb32331c462f8f3e77059c69578","lessThan":"b8948ac26efc395264a47f9a743889065adb5cff","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/soc/mediatek/mt8365/mt8365-afe-pcm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1094d83ad325829acd68e63147793536060a0d60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b8948ac26efc395264a47f9a743889065adb5cff","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f87707bc0406fe92bc142a9eee5f480c94ce9ff8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97415","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.223","lastModified":"2026-10-03T11:17:53.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF\n\nROOT_REF and ROOT_BACKREF items contain a struct btrfs_root_ref followed\nby the subvolume name. Several readers assume that this layout is already\nvalid and then use the on-disk name length directly. A corrupted item can\ntherefore make those readers address bytes outside the item, and\nBTRFS_IOC_GET_SUBVOL_INFO can copy too many bytes into its fixed-size UAPI\nname buffer.\n\nValidate ROOT_REF and ROOT_BACKREF items in tree-checker before any reader\nuses them. Reject records that do not contain a non-empty name, whose\nname_len does not exactly describe the remaining item payload, or whose\nname exceeds BTRFS_NAME_LEN.\n\nFor BTRFS_IOC_GET_SUBVOL_INFO, copy only the validated on-disk name_len\ninstead of deriving the copy length from the item size. The ioctl result is\nzeroed when allocated. That leaves the existing trailing zero byte\nuntouched."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/ioctl.c","fs/btrfs/tree-checker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"1370badf6b823ce3cde39a65f46f9e5dc7b4bf43","versionType":"git","status":"affected"},{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"ba6c4fc662853f6662e4db060cf88ee994053e21","versionType":"git","status":"affected"},{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"9154542070ca7eadb3c764a882f39a127677854b","versionType":"git","status":"affected"},{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"74f577c722c99248d804eca18e7de7c5e47549d7","versionType":"git","status":"affected"},{"version":"b64ec075bded2b30bcd90af5aa5256d2237c885d","lessThan":"0af37c217edf15fa21dac1c40822086df356c6bb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/ioctl.c","fs/btrfs/tree-checker.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0af37c217edf15fa21dac1c40822086df356c6bb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1370badf6b823ce3cde39a65f46f9e5dc7b4bf43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/74f577c722c99248d804eca18e7de7c5e47549d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9154542070ca7eadb3c764a882f39a127677854b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ba6c4fc662853f6662e4db060cf88ee994053e21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97416","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.340","lastModified":"2026-10-03T11:17:53.617","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk()\n\n[BUG]\nRunning btrfs balance can trigger a null-ptr-deref before relocating a\ndata chunk when metadata corruption leaves a chunk in the chunk tree\nwithout a corresponding block group in the in-memory cache:\n\n  KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f]\n  RIP: 0010:btrfs_may_alloc_data_chunk+0x40/0x1c0 fs/btrfs/volumes.c:3601\n  Call Trace:\n    __btrfs_balance fs/btrfs/volumes.c:4217 [inline]\n    btrfs_balance+0x2516/0x42b0 fs/btrfs/volumes.c:4604\n    btrfs_ioctl_balance fs/btrfs/ioctl.c:3577 [inline]\n    btrfs_ioctl+0x25cf/0x5b90 fs/btrfs/ioctl.c:5313\n    ...\n\n[CAUSE]\n__btrfs_balance() iterates the on-disk chunk tree and passes the chunk\nlogical bytenr to btrfs_may_alloc_data_chunk() before relocating a data\nchunk. That helper then queries the in-memory block group cache:\n\n  cache = btrfs_lookup_block_group(fs_info, chunk_offset);\n  chunk_type = cache->flags;   /* cache may be NULL */\n\nA corrupt image can contain a chunk item whose matching block group\nitem is missing, so no block group is ever inserted into the cache. In\nthat case btrfs_lookup_block_group() returns NULL.\n\nThe code only guards this with ASSERT(cache), which becomes a no-op when\nCONFIG_BTRFS_ASSERT is disabled. The subsequent dereference of\ncache->flags therefore crashes the kernel.\n\n[FIX]\nAdd a NULL check after btrfs_lookup_block_group() in\nbtrfs_may_alloc_data_chunk() and print and error message for clarity."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/btrfs/volumes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"9f37a6d6ae9e998232e2ba091ab4999cdf967e1b","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"e479236a8f4d85c4fb6b3f7c2556c21f583e2bf2","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"322f891b4d4fe64acb3351a0ffa62a7fa5ba7256","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"81a664ed8b1a44c76b204c4bd0d751317a02c5cd","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"9740dd0c17a4be8cc47a06c5ca5293471a7e286e","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"59f75e0c8724d4adebc08c7dd3ff2358b80c21f7","versionType":"git","status":"affected"},{"version":"a6f93c71d412ba8ed743152c3a54ad0b78dcd9c7","lessThan":"18d32b0013efba19f7ad3e5b08d7aee813d604a6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/btrfs/volumes.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.16","status":"affected"},{"version":"0","lessThan":"4.16","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/18d32b0013efba19f7ad3e5b08d7aee813d604a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/322f891b4d4fe64acb3351a0ffa62a7fa5ba7256","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/59f75e0c8724d4adebc08c7dd3ff2358b80c21f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/81a664ed8b1a44c76b204c4bd0d751317a02c5cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9740dd0c17a4be8cc47a06c5ca5293471a7e286e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f37a6d6ae9e998232e2ba091ab4999cdf967e1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e479236a8f4d85c4fb6b3f7c2556c21f583e2bf2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97417","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.457","lastModified":"2026-10-03T11:17:53.747","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()\n\nThe timestamp-only fast path dereferences the option stream as\n*(__be32 *)ptr, which assumes 4-byte alignment that the TCP option\nstream does not guarantee. Use get_unaligned_be32() instead, which\nreads the value safely and already returns host byte order, so the\nhtonl() on the comparison constant can be dropped.\n\nThis matches the existing get_unaligned_be32() use later in the same\nfunction."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_conntrack_proto_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"740ad3d17a281f7764dda4dbeb37cea52e2e31ae","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"a0523267de2523522b0f70972dd1ffa22ec6176c","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"55bcc3376cd7b18954cc9814da697504fdaf12bf","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"0d5ad732e4fdc569eb85861115e8f7b4c2c67852","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"7ecfa46a536578a7ed335ddf31a854127268c27c","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"4abc1af7ac209c066f4e5dd75cdd56876e5829a9","versionType":"git","status":"affected"},{"version":"bb9fc37358ffa9de1cc2b2b6f1a559b926ef50d9","lessThan":"d3bf9eae486490832bd08fd62ab0ac601f346bd4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_conntrack_proto_tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.1","status":"affected"},{"version":"0","lessThan":"3.1","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"references":[{"url":"https://git.kernel.org/stable/c/0d5ad732e4fdc569eb85861115e8f7b4c2c67852","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4abc1af7ac209c066f4e5dd75cdd56876e5829a9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55bcc3376cd7b18954cc9814da697504fdaf12bf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/740ad3d17a281f7764dda4dbeb37cea52e2e31ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7ecfa46a536578a7ed335ddf31a854127268c27c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0523267de2523522b0f70972dd1ffa22ec6176c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d3bf9eae486490832bd08fd62ab0ac601f346bd4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97418","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.613","lastModified":"2026-10-03T11:17:53.883","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: es18xx: check control allocation before private data setup\n\nsnd_es18xx_mixer() creates controls with snd_ctl_new1() and then stores\nbookkeeping pointers or sets private_free before calling snd_ctl_add().\nsnd_ctl_new1() can return NULL on allocation failure, so those writes\ncan dereference a NULL control pointer.\n\nCheck the returned control pointers before using them and return -ENOMEM\non allocation failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["sound/isa/es18xx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e6c84fe4cf6f98f7b1ad446a42cfcb46bae83f66","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"908323ed61d5e7ad74889524d327cfb6a65ec8df","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3d8adddf4e4a5a43847ee62e5e78ba05e756bdef","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"91c97a7969dae976de954453ab6e925e6522fecb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"978079238f40f1a08ddb12ce208c484246f6a1b0","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d88c24b76f285df9d206751e22c28e2613258cb3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"422e42b7c2b882ba1d16d4afc8891bcea7c4de93","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["sound/isa/es18xx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3d8adddf4e4a5a43847ee62e5e78ba05e756bdef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/422e42b7c2b882ba1d16d4afc8891bcea7c4de93","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/908323ed61d5e7ad74889524d327cfb6a65ec8df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/91c97a7969dae976de954453ab6e925e6522fecb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/978079238f40f1a08ddb12ce208c484246f6a1b0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d88c24b76f285df9d206751e22c28e2613258cb3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e6c84fe4cf6f98f7b1ad446a42cfcb46bae83f66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97419","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.733","lastModified":"2026-10-03T11:17:54.000","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhsr: broadcast netlink notifications in the device's net namespace\n\nThe HSR generic netlink family sets .netnsok = true. HSR devices can\nlive in network namespaces other than init_net.\n\nTwo async notifiers broadcast events with genlmsg_multicast(). They\nare hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers\nonly on the default genl socket in init_net. So the events always land\nin init_net. The network namespace of the device does not matter.\n\nThis has two effects. A listener in the device's own namespace never\nsees its own ring error and node down events. A privileged listener in\ninit_net receives events from HSR devices in other namespaces. The\npayload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port\nifindex (HSR_A_IFINDEX).\n\nSwitch both callers to genlmsg_multicast_netns(). Other families with\n.netnsok = true already do this. Examples are gtp, ovpn, team,\nbatman-adv, netdev-genl, ethtool and handshake.\n\nhsr_nl_ringerror() already has the slave port. It uses\ndev_net(port->dev). hsr_nl_nodedown() takes the namespace from the\nmaster port via hsr_port_get_hsr()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/hsr/hsr_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"9f13023607f1e95bd098cc49052b0c8955d334f9","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"798ccb12810a58a37264685b28ddf990ef49559c","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"9bf45feee630be868ab54e3d0f3d430c07471f0e","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"016b8eaca53bfd57e84ea28b5c9174c89d7679e1","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"25b69f281cebe051a8e4ab19950a939c27ead1bc","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"24b3f1a9982c176d05a523a4bb9314dca0db4488","versionType":"git","status":"affected"},{"version":"f421436a591d34fa5279b54a96ac07d70250cc8d","lessThan":"a762fabd7ef9a6cc07258684138f9c3f078d0326","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/hsr/hsr_netlink.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.13","status":"affected"},{"version":"0","lessThan":"3.13","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/016b8eaca53bfd57e84ea28b5c9174c89d7679e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24b3f1a9982c176d05a523a4bb9314dca0db4488","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25b69f281cebe051a8e4ab19950a939c27ead1bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/798ccb12810a58a37264685b28ddf990ef49559c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9bf45feee630be868ab54e3d0f3d430c07471f0e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f13023607f1e95bd098cc49052b0c8955d334f9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a762fabd7ef9a6cc07258684138f9c3f078d0326","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97420","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.853","lastModified":"2026-10-03T11:17:54.123","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: NUL-terminate replaced sysctl value\n\nWhen writing to sysctls, proc_sys_call_handler() guarantees that the\nbuffer passed to proc handlers is NUL-terminated. If\nbpf_sysctl_set_new_value() replaces the pending sysctl value, it can\nhand a replacement buffer directly to proc handlers. However, the\nhelper currently copies only buf_len bytes into that buffer without\nappending a NUL terminator, leaving downstream parsers vulnerable to\nout-of-bounds access.\n\nFix this by appending a '\\0' after the replaced value to restore the\nexpected sysctl semantics. Since the helper already rejects buf_len\ngreater than PAGE_SIZE - 1, there is always room for the extra byte.\n\nReproduced in a QEMU x86_64 guest booted with KASAN while exercising\nthe sysctl replacement path with a cgroup/sysctl BPF program. The\nreproducer targets `/proc/sys/net/core/flow_limit_cpu_bitmap`, fills\nthe original user write buffer with non-zero bytes, and overrides the\nsysctl value so the replacement buffer lacks a terminating NUL. Under\nthat setup, the pre-fix kernel reported:\n\n  BUG: KASAN: slab-out-of-bounds in strnchrnul+0x72/0x90\n  Read of size 1 at addr ffff88800de57000 by task repro_patch3/66\n  CPU: 0 UID: 0 PID: 66 Comm: repro_patch3 Not tainted 7.1.0-rc3-00269-g8370ca1f87cc #6 PREEMPT(lazy)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x68/0xa0\n   print_report+0xcb/0x5e0\n   ? __virt_addr_valid+0x21d/0x3f0\n   ? strnchrnul+0x72/0x90\n   ? strnchrnul+0x72/0x90\n   kasan_report+0xca/0x100\n   ? strnchrnul+0x72/0x90\n   strnchrnul+0x72/0x90\n   bitmap_parse+0x37/0x2e0\n   flow_limit_cpu_sysctl+0xc6/0x840\n   ? __pfx_flow_limit_cpu_sysctl+0x10/0x10\n   ? __kvmalloc_node_noprof+0x5ba/0x870\n   proc_sys_call_handler+0x31d/0x480\n   ? __pfx_proc_sys_call_handler+0x10/0x10\n   ? selinux_file_permission+0x39f/0x500\n   ? lock_is_held_type+0x9e/0x120\n   vfs_write+0x98e/0x1000\n   ...\n   </TASK>\n  The buggy address is located 0 bytes to the right of\n  allocated 4096-byte region [ffff88800de56000, ffff88800de57000)\nWith this fix applied, rerunning the same sysctl-targeted path yields\nno corresponding KASAN reports."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"bfcee1f79aaefa90679ad47690107fb7682724ec","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"c73e4a04eedc677fe91a736d7a5db45100adba5e","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"36d3e9f62dc2beb9299d3bb6f589cb9e07f773fe","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"31377675c3d75603d957c08e338a9ac27e9f6cd5","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"76c14b10f50eb0afcc76e244562fa2d8c661e224","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"3b2814dd842a565fcf9cc370156e1ba9eae16239","versionType":"git","status":"affected"},{"version":"32927393dc1ccd60fb2bdc05b9e8e88753761469","lessThan":"a66e3b5bacf38d6ab29fa05a9754f7a114485605","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/cgroup.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/31377675c3d75603d957c08e338a9ac27e9f6cd5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/36d3e9f62dc2beb9299d3bb6f589cb9e07f773fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3b2814dd842a565fcf9cc370156e1ba9eae16239","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/76c14b10f50eb0afcc76e244562fa2d8c661e224","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a66e3b5bacf38d6ab29fa05a9754f7a114485605","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfcee1f79aaefa90679ad47690107fb7682724ec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c73e4a04eedc677fe91a736d7a5db45100adba5e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97421","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:19.993","lastModified":"2026-10-03T11:17:54.257","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()\n\nSeveral corner cases, especially important on 32 bits:\n\n- umem->iova is u64, the function argument should pass in u64 or\n  iova will be truncated\n- Check that the length is not too large for the iova\n- Check that lengths > 4G don't overflow the GENMASK"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/umem.c","include/rdma/ib_umem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"3014da7587ce006cd08004fd6b257626b314e0a3","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"ddccf6cc3861de2fe60986933bead79220e0d797","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"e9bbb5f5349ef560ff6f0395564f04c3aa664559","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"ae3cf7d2c4d506c5c91746321644e1a08d989e2a","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"5fc5b73109540809b094710fac44da81dd8a3ff8","versionType":"git","status":"affected"},{"version":"a40c20dabdf9045270767c75918feb67f0727c89","lessThan":"09ea6837a0434fb4db99528a5055b6d822135dcf","versionType":"git","status":"affected"},{"version":"85e40ba1c4a5246b35e91c2ed69d4680426904d7","versionType":"git","status":"affected"},{"version":"59f07434b297e2268f5d5c567db5b09145245cf1","versionType":"git","status":"affected"},{"version":"488229b7729d7becf4c39c5e74fb709fb35115c2","versionType":"git","status":"affected"},{"version":"5.4.73","lessThan":"5.5","versionType":"semver","status":"affected"},{"version":"5.8.17","lessThan":"5.9","versionType":"semver","status":"affected"},{"version":"5.9.2","lessThan":"5.10","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/umem.c","include/rdma/ib_umem.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.10","status":"affected"},{"version":"0","lessThan":"5.10","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/09ea6837a0434fb4db99528a5055b6d822135dcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3014da7587ce006cd08004fd6b257626b314e0a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5fc5b73109540809b094710fac44da81dd8a3ff8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae3cf7d2c4d506c5c91746321644e1a08d989e2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ddccf6cc3861de2fe60986933bead79220e0d797","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9bbb5f5349ef560ff6f0395564f04c3aa664559","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97422","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.113","lastModified":"2026-10-21T13:21:09.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix SMI event cross-process information leak\n\nkfd_smi_ev_enabled() skips the suser privilege check when pid=0.\nPROCESS_START, PROCESS_END, and VMFAULT events are emitted with\npid=0 while carrying another process's PID and command name, so any\n/dev/kfd user in the render group can monitor all GPU workloads.\n\nPass the target process PID into kfd_smi_event_add() for these events\nso the existing per-client filter restricts delivery to the owning\nprocess or CAP_SYS_ADMIN subscribers."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"938a0650aae6275ba8e924685836bdee2c6aa3db","lessThan":"6fc7ab7fcd7eefb2f371a1d43cf7a860a08f922a","versionType":"git","status":"affected"},{"version":"938a0650aae6275ba8e924685836bdee2c6aa3db","lessThan":"470319a893f616ef661a63e825a8e1b9b6eddb91","versionType":"git","status":"affected"},{"version":"938a0650aae6275ba8e924685836bdee2c6aa3db","lessThan":"5bb2dfa65d8da83e87b2a31c270bc567df69a5ca","versionType":"git","status":"affected"},{"version":"938a0650aae6275ba8e924685836bdee2c6aa3db","lessThan":"92a8dba246d371fe268280e5fd74b0955688e6df","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/470319a893f616ef661a63e825a8e1b9b6eddb91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bb2dfa65d8da83e87b2a31c270bc567df69a5ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fc7ab7fcd7eefb2f371a1d43cf7a860a08f922a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/92a8dba246d371fe268280e5fd74b0955688e6df","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97423","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.227","lastModified":"2026-09-25T13:17:25.867","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncxl/region: Validate partition index before array access\n\nconstruct_region() reads cxled->part and uses it to index\ncxlds->part[] without checking for a negative value. If the\npartition was never resolved, part remains at its initial value\nof -1, causing an out-of-bounds array access.\n\nAdd a guard to return -EBUSY when part is negative.\n\nThe check was dropped during a merge."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/cxl/core/region.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b6faa9c613787b894913638a76030018f6d62d54","lessThan":"06322da06116f1ee52271dd4d84dc69580087df7","versionType":"git","status":"affected"},{"version":"b6faa9c613787b894913638a76030018f6d62d54","lessThan":"16329b510f76e5b824e05bf8add8b29850f1f16f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/cxl/core/region.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/06322da06116f1ee52271dd4d84dc69580087df7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16329b510f76e5b824e05bf8add8b29850f1f16f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97424","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.340","lastModified":"2026-10-21T13:21:09.637","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq\n\ncp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but\nreleased in gfx_v9_0_hw_fini(), so the put site has to query\namdgpu_irq_enabled() because the get is skipped on SR-IOV VF.\n\nras_late_init / ras_fini have no suspend counterpart, so move the\nput to amdgpu_gfx_ras_suspend() / amdgpu_gfx_ras_fini() and add a\nmatching ras_suspend callback that is invoked from\namdgpu_ras_suspend() before disable_all_features().  The get and\nput now sit in the same place and check the same condition (not\nVF, funcs registered), no refcount querying needed.\n\nAn active flag gates ras_fini so the\nsuspend-then-unload-without-resume path falls into\namdgpu_ras_block_late_fini_default() instead of double-releasing\nwhat ras_suspend already cleaned up.\n\nDrop the cp_ecc_error_irq put from gfx_v9_0_hw_fini().  gfx_v8_0\nmanages cp_ecc_error_irq locally and is unaffected; no other GFX\ngeneration has this IRQ."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c","drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h","drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h","drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"760a1d55344d823287850466db893ed77e948803","lessThan":"c1f2f34d681a0b354e1218b83245d1f2d2139a8d","versionType":"git","status":"affected"},{"version":"760a1d55344d823287850466db893ed77e948803","lessThan":"5b761927dbb170df4716d9c0ef85e178a1856e64","versionType":"git","status":"affected"},{"version":"760a1d55344d823287850466db893ed77e948803","lessThan":"001824103f2fe6ffd2380afddf81f43b446035b2","versionType":"git","status":"affected"},{"version":"760a1d55344d823287850466db893ed77e948803","lessThan":"e3829992dd9fa0a82511af4f01733fc854cd15a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c","drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.h","drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c","drivers/gpu/drm/amd/amdgpu/amdgpu_ras.h","drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.2","status":"affected"},{"version":"0","lessThan":"5.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/001824103f2fe6ffd2380afddf81f43b446035b2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b761927dbb170df4716d9c0ef85e178a1856e64","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1f2f34d681a0b354e1218b83245d1f2d2139a8d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3829992dd9fa0a82511af4f01733fc854cd15a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97425","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.450","lastModified":"2026-10-03T11:17:54.400","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix buffer overflow during vBIOS update\n\nClamp the buffer postion to write by setting the bin attribute\nto the maximum buffer size so that VFS layer will block the\nout-of-bounds accessing."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8424f2ccb3c0dd43369288a47d15c980136c3bd5","lessThan":"4a1b0a4c5acbe96368d71157b264dcd917ba6c9e","versionType":"git","status":"affected"},{"version":"8424f2ccb3c0dd43369288a47d15c980136c3bd5","lessThan":"c7b2af01ee2ecfb8f2289dc83524d8fb1ec72992","versionType":"git","status":"affected"},{"version":"8424f2ccb3c0dd43369288a47d15c980136c3bd5","lessThan":"29fef371331e87311822000535f491ffc3d7a64f","versionType":"git","status":"affected"},{"version":"8424f2ccb3c0dd43369288a47d15c980136c3bd5","lessThan":"6229898d46c0cbc238a6fe9f11c1ea12cf8bb9c5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.19","status":"affected"},{"version":"0","lessThan":"5.19","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/29fef371331e87311822000535f491ffc3d7a64f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4a1b0a4c5acbe96368d71157b264dcd917ba6c9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6229898d46c0cbc238a6fe9f11c1ea12cf8bb9c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7b2af01ee2ecfb8f2289dc83524d8fb1ec72992","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97426","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.570","lastModified":"2026-09-25T13:17:26.150","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/pm: fix SmartShift bias sysfs store PM refcount on parse error\n\nReturn the parse error before acquiring PM access."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/pm/amdgpu_pm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"55aa33c3fe38763e4f285d5192fb9892133360a7","lessThan":"95e13b25196295654563028861e6802807006ad4","versionType":"git","status":"affected"},{"version":"55aa33c3fe38763e4f285d5192fb9892133360a7","lessThan":"a4b0c3f5d2287997876d8f711a40d3c0418458d8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/pm/amdgpu_pm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/95e13b25196295654563028861e6802807006ad4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4b0c3f5d2287997876d8f711a40d3c0418458d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97427","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.680","lastModified":"2026-10-03T11:17:54.500","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/pm: bound pp_dpm_set_pp_table() memcpy\n\nThe powerplay path allocates hardcode_pp_table once with kmemdup(...,\nsoft_pp_table_size). memcpy(..., size) used the sysfs store count (up to\nPAGE_SIZE) with no upper bound, causing heap overflow. Reject\nwrites where size exceeds soft_pp_table_size."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"abe61d067b48b947bedc9bae3725cb8f48dc8c0a","versionType":"git","status":"affected"},{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"9b5cb2e4eb297fe52be26fd895fc5ea28fc22bf9","versionType":"git","status":"affected"},{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"43d2ab8408f9f468b232350c74160ae21e763020","versionType":"git","status":"affected"},{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"3334985f8b4c7c637a829744c81518ad9a671bcb","versionType":"git","status":"affected"},{"version":"b9c1a77e8cd73aa42c2736b6b0ffddda6230af1a","lessThan":"f193e71fa9fab2e68ef85201b106e8f580d3a25b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/pm/powerplay/amd_powerplay.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3334985f8b4c7c637a829744c81518ad9a671bcb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/43d2ab8408f9f468b232350c74160ae21e763020","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b5cb2e4eb297fe52be26fd895fc5ea28fc22bf9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abe61d067b48b947bedc9bae3725cb8f48dc8c0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f193e71fa9fab2e68ef85201b106e8f580d3a25b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97428","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.797","lastModified":"2026-10-21T13:21:09.770","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: harden FRU PIA parsing with bounded helpers\n\nReplace the open-coded TLV walk with fru_pia_advance()\nand fru_pia_copy_field() helpers that bound every read\nby the actual EEPROM data length, preventing out-of-bounds\nreads on truncated or malformed FRU data."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0dbf2c56262532fbd498f590c91c4085413b8829","lessThan":"567d7c3f93f8d6bdc946a557a160ee1c42cfae91","versionType":"git","status":"affected"},{"version":"0dbf2c56262532fbd498f590c91c4085413b8829","lessThan":"813311512505e95e4e3c898ff94b11886a15e494","versionType":"git","status":"affected"},{"version":"0dbf2c56262532fbd498f590c91c4085413b8829","lessThan":"4396d74b0c7304946ee343a6611ac6dbc0bfbf78","versionType":"git","status":"affected"},{"version":"0dbf2c56262532fbd498f590c91c4085413b8829","lessThan":"c990c05eb6c74c98d1ff3acf67a19015312820b7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_fru_eeprom.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.2","status":"affected"},{"version":"0","lessThan":"6.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/4396d74b0c7304946ee343a6611ac6dbc0bfbf78","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/567d7c3f93f8d6bdc946a557a160ee1c42cfae91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/813311512505e95e4e3c898ff94b11886a15e494","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c990c05eb6c74c98d1ff3acf67a19015312820b7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97429","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:20.907","lastModified":"2026-10-03T11:17:54.607","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: fix UAF race in destroy_queue_cpsch\n\nwait_on_destroy_queue() drops locks to wait for queue resume, allowing\na concurrent destroy to free the queue. Use is_being_destroyed flag to\nserialize destruction."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a70a93fa568b4f05aba548dadb673703eccf5480","lessThan":"090b51e2dabf88c02c0b6b25ea672a8bddfba7d5","versionType":"git","status":"affected"},{"version":"a70a93fa568b4f05aba548dadb673703eccf5480","lessThan":"41144829f4645c2bd4cb501d34d253858f750c0a","versionType":"git","status":"affected"},{"version":"a70a93fa568b4f05aba548dadb673703eccf5480","lessThan":"d98c8032c29944e1e572e1f49a0613d364fece0f","versionType":"git","status":"affected"},{"version":"a70a93fa568b4f05aba548dadb673703eccf5480","lessThan":"ac081deaf16a639ea7dff2f285fe421a33c1ade0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/090b51e2dabf88c02c0b6b25ea672a8bddfba7d5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41144829f4645c2bd4cb501d34d253858f750c0a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac081deaf16a639ea7dff2f285fe421a33c1ade0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d98c8032c29944e1e572e1f49a0613d364fece0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97430","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.017","lastModified":"2026-10-03T11:17:54.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Prevent queuing new commands if xhci is inaccessible\n\nRefuse to queue a new command on the command ring if xHC is marked\ninaccessible with the HCD_FLAG_HW_ACCESSIBLE.\n\nHCD_FLAG_HW_ACCESSIBLE is set and cleared in suspend and resume.\n\nAlso print a warning if xhci is being suspended with commands\nstill pending on the command ring."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/host/xhci-ring.c","drivers/usb/host/xhci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"0e2eaa000e4e5ad46b7cf8fcf1e4a2585ef8b5a8","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"add3aeb74e2c7d82fa1035af2a027666c6906210","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"a215190ef68ca3602fe00674e0efffad71beb3aa","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"fec259e46d44317379834a44115fae66122dc93f","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"a50948386256b24d73971b9a152fe1de808446ab","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"a05e54c1eeaba10414aa2fde94589a7c9885f2a1","versionType":"git","status":"affected"},{"version":"5535b1d5f8885695c6ded783c692e3c0d0eda8ca","lessThan":"82b70c799281cc24506085be978b829149ba0ca4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/host/xhci-ring.c","drivers/usb/host/xhci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.37","status":"affected"},{"version":"0","lessThan":"2.6.37","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0e2eaa000e4e5ad46b7cf8fcf1e4a2585ef8b5a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/82b70c799281cc24506085be978b829149ba0ca4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a05e54c1eeaba10414aa2fde94589a7c9885f2a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a215190ef68ca3602fe00674e0efffad71beb3aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a50948386256b24d73971b9a152fe1de808446ab","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/add3aeb74e2c7d82fa1035af2a027666c6906210","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fec259e46d44317379834a44115fae66122dc93f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97431","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.123","lastModified":"2026-09-25T13:17:26.733","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd/display: Avoid DPMS-on for phantom stream\n\n[Why & How]\nCalling dc_update_planes_and_stream separately for stream and its\nphantom stream causes a NULL pointer dereference, since the phantom is\ndestroyed on the first call.\n\nSkip the call for phantom streams."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9c6669c2e21a2d9b3f3857883c715a302ae64ac0","lessThan":"f2463fc246d3c39be1371389c52b29418ad673d0","versionType":"git","status":"affected"},{"version":"9c6669c2e21a2d9b3f3857883c715a302ae64ac0","lessThan":"10f5f9c0ef32d08b228bfee3684b62f36f395852","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/display/dc/link/accessories/link_dp_cts.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/10f5f9c0ef32d08b228bfee3684b62f36f395852","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2463fc246d3c39be1371389c52b29418ad673d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97432","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.237","lastModified":"2026-10-21T13:21:09.923","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix P2P-Device binding handling\n\nOur binding handling for P2P-Device can run into the following\nscenario, as observed by our testing:\n\n - a station interface is connected on some channel\n - the P2P-Device does a remain-on-channel (ROC) on that channel\n - the ROC ends, and the P2P-Device is removed from the binding,\n   but the phy_ctxt pointer is left around as a PHY cache so we\n   don't need to recalibrate to the channel again and again in\n   case it's not shared\n - a binding update by the station interface, even a removal,\n   will re-add the P2P-Device to the binding\n - the P2P-Device is removed, which removes the PHY context, but\n   it's still in the binding so the firmware crashes\n\nSince the P2P device is removed from the binding and only re-\nadded by unrelated code, but we want to keep the phy_ctxt around\nas a cache for future ROC usage, fix it by adding a boolean that\nindicates whether or not the P2P-Device should be added to the\nbinding, and handle that in the binding iterator. That way, the\nstation interface cannot re-add the P2P-Device to the binding\nwhen that isn't active."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/binding.c","drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c","drivers/net/wireless/intel/iwlwifi/mvm/mvm.h","drivers/net/wireless/intel/iwlwifi/mvm/time-event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"64c277f6329818db3124c9759cb9acf0f6070a54","lessThan":"50bf37362362c8f03ab1aeab866b7fb08b262204","versionType":"git","status":"affected"},{"version":"84ef7cbe90e9e54c71c1da4e645ba34e1b33da77","lessThan":"8575514a979490c9d4517fcf19b4e19119c27702","versionType":"git","status":"affected"},{"version":"84ef7cbe90e9e54c71c1da4e645ba34e1b33da77","lessThan":"7be2fc679c8f657868988e41c0bb15bf5a454620","versionType":"git","status":"affected"},{"version":"84ef7cbe90e9e54c71c1da4e645ba34e1b33da77","lessThan":"b74e377cad9271950c57472867c469e4b5b2ff0c","versionType":"git","status":"affected"},{"version":"8ddf2212cfa5d9ef4fd289ce0d9dda728f2160b8","versionType":"git","status":"affected"},{"version":"6.6.2","lessThan":"6.6.160","versionType":"semver","status":"affected"},{"version":"6.5.12","lessThan":"6.6","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mvm/binding.c","drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c","drivers/net/wireless/intel/iwlwifi/mvm/mvm.h","drivers/net/wireless/intel/iwlwifi/mvm/time-event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/50bf37362362c8f03ab1aeab866b7fb08b262204","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7be2fc679c8f657868988e41c0bb15bf5a454620","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8575514a979490c9d4517fcf19b4e19119c27702","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b74e377cad9271950c57472867c469e4b5b2ff0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97433","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.350","lastModified":"2026-09-25T13:17:26.930","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: validate FDP configuration descriptor sizes\n\nValidate descriptor sizes while walking the FDP configurations log so\ndsze == 0 or a descriptor past the log end cannot cause unbounded\niteration or reads past the buffer."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/nvme/host/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"30b5f20bb2ddab013035399e5c7e6577da49320a","lessThan":"97efd7a41aac08b43ea2337c5913a2bc75484f9f","versionType":"git","status":"affected"},{"version":"30b5f20bb2ddab013035399e5c7e6577da49320a","lessThan":"0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/nvme/host/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0ef4daa6534a510d61ea67c8ad9bb5097b0dd5f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/97efd7a41aac08b43ea2337c5913a2bc75484f9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97434","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.453","lastModified":"2026-10-03T11:17:54.850","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: fix handling of NAPI on the remove path\n\nAll the NAPI instances for a DPSW device are attached to the first\nswitch port's net_device but shared by all ports. The NAPI instances get\ndisabled only once the last port goes down.\n\nThis causes an issue on the .remove() path where each port is\nunregistered and freed one at a time, causing the NAPI instances to be\ndeleted even though they are not disabled.\n\nIn order to avoid this, split up the unregister_netdev() calls from the\nfree_netdev() so that we make sure all ports go down before we attempt\na deletion of NAPI instances. Also, make the netif_napi_del() explicit\nas it is on the .probe() path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"d39603e21087e9ef9cd125e5895cdc70b2eb154d","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"bd16f46d0796109d241d6311a7577f9956467c96","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"c996faba71fc465ad12c6d177bd1a9ad974f9ee8","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"569df157eb874cb3b50554d73b89f31599397b42","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"6518f87771c8833e587bd9881346fa759651c2ae","versionType":"git","status":"affected"},{"version":"0b1b71370458860579831e77485883fcf2e8fbbe","lessThan":"e23d7c8c1d4ba435c457d7ffb2669175ec819b07","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/569df157eb874cb3b50554d73b89f31599397b42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6518f87771c8833e587bd9881346fa759651c2ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd16f46d0796109d241d6311a7577f9956467c96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c996faba71fc465ad12c6d177bd1a9ad974f9ee8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d39603e21087e9ef9cd125e5895cdc70b2eb154d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e23d7c8c1d4ba435c457d7ffb2669175ec819b07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97435","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.573","lastModified":"2026-10-03T11:17:54.967","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: sja1105: flower: reject cross-chip redirect\n\ndsa_port_from_netdev() may return a valid port from a different switch\nchip. Programming another chip's port index into the local hardware\ncauses redirection to the wrong port, or an out-of-bounds access if the\nindex exceeds the local chip's port count.\n\nApply a minimal fix that adds a check to catch this case and adjusts the\nextack message. When cls->common.skip_sw is not set, the operation could\ninstead redirect to the upstream port and let the software or upstream\nswitch(es) handle the forward, but that is not addressed here."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/dsa/sja1105/sja1105_flower.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"6bf5158af52a5293e9160d8f2992c629ca14aa7d","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"277f8611e017d3ff1ab06af58a6c538b55da1cc8","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"eb177aa00c392de3dc530c34f173a962216f82dd","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"d0e54098c072b6064cdcf8039075ada8b88583da","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"c999cc39775381b68ed66eae57c1425452672c0f","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"abd7511e12b231798332afa04ed9bee9e84f9445","versionType":"git","status":"affected"},{"version":"dfacc5a23e227cabdff41b6202f510398e90d36b","lessThan":"cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/dsa/sja1105/sja1105_flower.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/277f8611e017d3ff1ab06af58a6c538b55da1cc8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6bf5158af52a5293e9160d8f2992c629ca14aa7d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abd7511e12b231798332afa04ed9bee9e84f9445","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c999cc39775381b68ed66eae57c1425452672c0f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cfa5274a5dc2a23b957da5dc806d2ac0c7a66af0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0e54098c072b6064cdcf8039075ada8b88583da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eb177aa00c392de3dc530c34f173a962216f82dd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97436","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.697","lastModified":"2026-10-03T11:17:55.083","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndpaa2-switch: rework FDB management on the bridge leave path\n\nOn bridge leave, the dpaa2_switch_port_set_fdb() function always\nallocates a new FDB for the port which is becoming standalone. In case\nno FDB is found, then the port leaving a bridge will continue to use the\ncurrent one.\n\nThe above logic does not cover the case in which there are multiple\nbridges which have ports from the same DPSW instance. In this case, when\nthe last port leaves bridge #1, it finds an unused FDB to switch to, but\nthe old FDB is not marked as unused. Since the number of FDBs is equal\nto the number of DPSW interfaces, this will eventually lead to multiple\nports sharing the same FDB.\n\nFix this by changing how we are managing the FDBs on the leave path.\nInstead of directly allocating a new FDB, first verify if the current\nport is the last one to leave a bridge. If this is the case, then\ncontinue to use the current FDB and only allocate another FDB if there\nare other ports remaining in the bridge."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"ec41bfd281a8bc8027a42d2674eac5b74947ff7a","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"e07ff2338f45adbf572850335d761c2f97545935","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"dc626f2abb3052881911b6166a9425739ce80085","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"abea361a11e4e48695ea149652ef5d3f308b6a49","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"5adbc4d02d7df8bd7aa02c21874f7a582a576b55","versionType":"git","status":"affected"},{"version":"539dda3c5d190c5088b5e57944b1b482fcb464de","lessThan":"efc1d92eacf03afa6f4d53bf7120e059b6f961f2","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5adbc4d02d7df8bd7aa02c21874f7a582a576b55","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/abea361a11e4e48695ea149652ef5d3f308b6a49","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dc626f2abb3052881911b6166a9425739ce80085","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e07ff2338f45adbf572850335d761c2f97545935","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec41bfd281a8bc8027a42d2674eac5b74947ff7a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/efc1d92eacf03afa6f4d53bf7120e059b6f961f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97437","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.810","lastModified":"2026-10-03T11:17:55.200","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()\n\nThe bounds check in ntfs_dir_emit() compares fname->name_len (a\ncharacter count) against e->size (a byte count) without accounting\nfor the 2-byte-per-character UTF-16LE encoding or the ATTR_FILE_NAME\nheader size:\n\n  if (fname->name_len + sizeof(struct NTFS_DE) > le16_to_cpu(e->size))\n\nThis computes: name_len + 16 > e_size\n\nThe correct check must account for the ATTR_FILE_NAME header (66 bytes\nbefore the name) and the UTF-16LE character size (2 bytes each):\n\n  sizeof(NTFS_DE) + offsetof(ATTR_FILE_NAME, name) +\n  name_len * sizeof(short) > e_size\n\nWhich computes: 16 + 66 + name_len * 2 > e_size\n\nThe correct calculation already exists as fname_full_size() in ntfs.h\nand is used in cmp_fnames(), namei.c, and fslog.c, but was not used\nin the readdir path.\n\nA crafted NTFS image with an index entry containing a small e->size\nbut large fname->name_len bypasses the current check, causing\nntfs_utf16_to_nls() to read past the entry boundary.\n\nAdditionally, add a key_size validation in hdr_find_e() to ensure the\ndeclared key_size does not exceed the available entry data, preventing\ncomparison functions from reading past entry boundaries on the lookup\npath."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/dir.c","fs/ntfs3/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"d1f98938e437732c0ecdfc8ee451e12a072f6d07","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"0505f1e7bb5b981b6ed62d98b26ddce76142865d","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"ed6da1abeec50db9060d714f03743fe0b63e4fe4","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"6a8149a20e46086c756c2a9202e377c0b649a0c3","versionType":"git","status":"affected"},{"version":"4342306f0f0d5ff4315a204d315c1b51b914fca5","lessThan":"aa1bdbb39f49c5bc9779316891c40005517842a5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/dir.c","fs/ntfs3/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0505f1e7bb5b981b6ed62d98b26ddce76142865d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2f7d0ec8c10dc7bf7a8c9a9cb169f9a4d1fac2ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6a8149a20e46086c756c2a9202e377c0b649a0c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa1bdbb39f49c5bc9779316891c40005517842a5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1f98938e437732c0ecdfc8ee451e12a072f6d07","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ed6da1abeec50db9060d714f03743fe0b63e4fe4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97438","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:21.930","lastModified":"2026-10-03T11:17:55.350","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: validate index entry key bounds\n\n[BUG]\nA malformed NTFS directory index entry can advertise a key_size larger\nthan the bytes actually present in its NTFS_DE payload. Directory lookup\nthen passes that malformed key to cmp_fnames(), which can read past the\nend of the kmalloc'ed index buffer.\n\nBUG: KASAN: slab-out-of-bounds in fname_full_size fs/ntfs3/ntfs.h:590 [inline]\nBUG: KASAN: slab-out-of-bounds in cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46\nRead of size 1 at addr ffff88801c313018 by task syz.6.3365/9279\n\nCall Trace:\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xd1/0x650 mm/kasan/report.c:482\n kasan_report+0xfb/0x140 mm/kasan/report.c:595\n __asan_report_load1_noabort+0x14/0x30 mm/kasan/report_generic.c:378\n fname_full_size fs/ntfs3/ntfs.h:590 [inline]\n cmp_fnames+0x1ea/0x230 fs/ntfs3/index.c:46\n hdr_find_e.isra.0+0x3ed/0x670 fs/ntfs3/index.c:762\n indx_find+0x4b5/0x900 fs/ntfs3/index.c:1186\n dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254\n ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85\n __lookup_slow+0x241/0x450 fs/namei.c:1816\n lookup_slow fs/namei.c:1833 [inline]\n walk_component+0x31c/0x570 fs/namei.c:2151\n link_path_walk+0x592/0xd60 fs/namei.c:2519\n path_lookupat+0x138/0x660 fs/namei.c:2675\n filename_lookup+0x1f3/0x560 fs/namei.c:2705\n filename_setxattr+0xad/0x1c0 fs/xattr.c:660\n path_setxattrat+0x1d8/0x280 fs/xattr.c:713\n __do_sys_lsetxattr fs/xattr.c:754 [inline]\n __se_sys_lsetxattr fs/xattr.c:750 [inline]\n __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750\n ...\n\nAllocated by task 9279:\n kasan_save_stack+0x39/0x70 mm/kasan/common.c:56\n kasan_save_track+0x14/0x40 mm/kasan/common.c:77\n kasan_save_alloc_info+0x37/0x60 mm/kasan/generic.c:573\n poison_kmalloc_redzone mm/kasan/common.c:400 [inline]\n __kasan_kmalloc+0xc3/0xd0 mm/kasan/common.c:417\n kasan_kmalloc include/linux/kasan.h:262 [inline]\n __do_kmalloc_node mm/slub.c:5650 [inline]\n __kmalloc_noprof+0x2bd/0x900 mm/slub.c:5662\n kmalloc_noprof include/linux/slab.h:961 [inline]\n indx_read+0x41d/0xad0 fs/ntfs3/index.c:1059\n indx_find+0x447/0x900 fs/ntfs3/index.c:1179\n dir_search_u+0x2c0/0x460 fs/ntfs3/dir.c:254\n ntfs_lookup+0x1cc/0x2a0 fs/ntfs3/namei.c:85\n __lookup_slow+0x241/0x450 fs/namei.c:1816\n lookup_slow fs/namei.c:1833 [inline]\n walk_component+0x31c/0x570 fs/namei.c:2151\n link_path_walk+0x592/0xd60 fs/namei.c:2519\n path_lookupat+0x138/0x660 fs/namei.c:2675\n filename_lookup+0x1f3/0x560 fs/namei.c:2705\n filename_setxattr+0xad/0x1c0 fs/xattr.c:660\n path_setxattrat+0x1d8/0x280 fs/xattr.c:713\n __do_sys_lsetxattr fs/xattr.c:754 [inline]\n __se_sys_lsetxattr fs/xattr.c:750 [inline]\n __x64_sys_lsetxattr+0xd0/0x150 fs/xattr.c:750\n ...\n\n[CAUSE]\nThe index-header validators only validated INDEX_HDR-level geometry.\nThey did not walk each NTFS_DE to verify entry alignment, subnode\nlayout, or that key_size fit inside the entry payload. They also\nallowed a last sentinel entry to carry a non-zero key_size.\n\n[FIX]\nWalk every NTFS_DE in ntfs3's index-header validators and reject\nentries with invalid layout, mismatched subnode state, oversized\nkey_size, or non-zero sentinel keys before lookup or log replay can\nconsume them."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/fslog.c","fs/ntfs3/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"c8d93bc4823baecab3c39b877e16ac5f8d4d41ba","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"7feeb424bda7f6ffaf5090cdd01b300eaa74c02b","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"d564a885219a655077eefafeb72395a4580ebd69","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"a8f4fb6a7d58974ffc9aed597401528b181d76dc","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"0257e3ea00e19129f3ad5c039d8b8fdff0796835","versionType":"git","status":"affected"},{"version":"82cae269cfa953032fbb8980a7d554d60fb00b17","lessThan":"98d6e5d9dc1d34dcffc61549617581a5fe1ef807","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/fslog.c","fs/ntfs3/index.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/0257e3ea00e19129f3ad5c039d8b8fdff0796835","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7feeb424bda7f6ffaf5090cdd01b300eaa74c02b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98d6e5d9dc1d34dcffc61549617581a5fe1ef807","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8f4fb6a7d58974ffc9aed597401528b181d76dc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c8d93bc4823baecab3c39b877e16ac5f8d4d41ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d564a885219a655077eefafeb72395a4580ebd69","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97439","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.073","lastModified":"2026-10-03T11:17:55.520","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib\n\n[BUG]\nA corrupted ntfs3 image can hit a NULL function pointer call in\ngeneric_perform_write() after toggling system.ntfs_attrib and then\noverwriting system.dos_attrib on the same file.\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\n\\#PF: supervisor instruction fetch in kernel mode\n\\#PF: error_code(0x0010) - not-present page\nPGD bed5067 P4D bed5067 PUD 0\nOops: Oops: 0010 [#1] SMP KASAN NOPTI\nRIP: 0010:0x0\nCode: Unable to access opcode bytes at 0xffffffffffffffd6.\nRSP: 0018:ffff88801025f988 EFLAGS: 00010246\nCall Trace:\n generic_perform_write+0x409/0x8c0 mm/filemap.c:4255\n __generic_file_write_iter+0x1bb/0x200 mm/filemap.c:4372\n ntfs_file_write_iter+0xcd9/0x1c20 fs/ntfs3/file.c:1253\n new_sync_write fs/read_write.c:593 [inline]\n vfs_write+0x63b/0xf70 fs/read_write.c:686\n ksys_write+0x133/0x250 fs/read_write.c:738\n __do_sys_write fs/read_write.c:749 [inline]\n __se_sys_write fs/read_write.c:746 [inline]\n __x64_sys_write+0x77/0xc0 fs/read_write.c:746\n ...\n\n[CAUSE]\nsystem.ntfs_attrib updates ATTR_DATA flags via ni_new_attr_flags()\nand switches i_mapping->a_ops to ntfs_aops_cmpr when\nFILE_ATTRIBUTE_COMPRESSED is set. system.dos_attrib then overwrites\nni->std_fa from a one-byte DOS attribute value, clearing the compression\nbit without updating ATTR_DATA or the mapping operations.\n\nOld buffered writes use is_compressed(ni) to choose\n__generic_file_write_iter(). That leaves generic_perform_write() calling\na NULL write_begin callback from ntfs_aops_cmpr.\n\n[FIX]\nTreat system.dos_attrib as a low-byte DOS attribute update and preserve the\nexisting non-DOS attribute bits in ni->std_fa. This keeps compressed and\nsparse state consistent with ATTR_DATA and the mapping operations while\nkeeping the existing DOS attribute semantics intact."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"533217b90addd57cc16f1c974e023c72d18949c7","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"f2d6bc89e2236939df189831707c8cdad199f57a","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"fdc9f65aa6631df04238c6154713bacd5133d77c","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"2de91ae285b0b878604d2bd83c3c395a8071e482","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"407ee19828a7d9700969ed9cc53be50d0f533619","versionType":"git","status":"affected"},{"version":"be71b5cba2e6485e8959da7a9f9a44461a1bb074","lessThan":"b1c1101067d9536bcb0fe023b96ee2dde5535959","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/2de91ae285b0b878604d2bd83c3c395a8071e482","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/407ee19828a7d9700969ed9cc53be50d0f533619","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/533217b90addd57cc16f1c974e023c72d18949c7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b1c1101067d9536bcb0fe023b96ee2dde5535959","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2d6bc89e2236939df189831707c8cdad199f57a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fdc9f65aa6631df04238c6154713bacd5133d77c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97440","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.197","lastModified":"2026-10-03T11:17:55.643","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix node refcount leak on ctrl packet alloc failure\n\nqrtr_send_resume_tx() calls qrtr_node_lookup() which takes a\nreference on the returned node. If the subsequent call to\nqrtr_alloc_ctrl_packet() fails due to memory allocation failure, the\nfunction returns -ENOMEM without calling qrtr_node_release() to\nrelease the node reference.\n\nAdd qrtr_node_release(node) before returning on the allocation failure\npath to properly release the reference."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/qrtr/af_qrtr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"78d066ecac9ce50441d4affae0df2093c4c3e62e","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"f3e90fbcd2d5ec1632bc2e8cdd1218f56bcb5fcf","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"c3515740174b778d0ee44acc477b51a6478da6b8","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"f76a39c45182d9137e053081cee9f2c197404ce6","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"477353db343663d5502ca442c6de785d2f23f273","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"9d969c98732a4d42212ec580dd5bbad53f246103","versionType":"git","status":"affected"},{"version":"cb6530b99fafea6c0636c4640bd21301d12cdbc9","lessThan":"3b09ff54114566864eea59020f6b69c5bb325b9d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/qrtr/af_qrtr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.6","status":"affected"},{"version":"0","lessThan":"5.6","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3b09ff54114566864eea59020f6b69c5bb325b9d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/477353db343663d5502ca442c6de785d2f23f273","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78d066ecac9ce50441d4affae0df2093c4c3e62e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d969c98732a4d42212ec580dd5bbad53f246103","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c3515740174b778d0ee44acc477b51a6478da6b8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3e90fbcd2d5ec1632bc2e8cdd1218f56bcb5fcf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f76a39c45182d9137e053081cee9f2c197404ce6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97441","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.313","lastModified":"2026-10-03T11:17:55.757","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nata: ahci: fail probe if BAR too small for claimed ports\n\nWhen an AHCI controller is disabled in BIOS, its HOST_CAP register may\ncontain a bogus value, e.g. 0xFFFFFFFF.\n\nSince CAP.NP (Number of Ports) is a zeroes based 5-bit register field,\na value of 0x1f means 32 ports. If CAP.NP claims more ports than can\nphysically fit within the mapped BAR region, accessing port registers\nbeyond the BAR boundary causes a kernel panic.\n\nAdd validation in ahci_init_one() to check that the BAR size is\nsufficient for the number of ports claimed in CAP.NP. The check\ncalculates the required MMIO size as:\n\n  required_size = 0x100 (global registers) + max_ports * 0x80\n\nIf required_size exceeds the actual BAR size, the probe fails with\n-ENODEV, preventing the panic and providing a clear error message.\n\n[cassel: commit log]"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/ata/ahci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"533a08ea11217100cec7a0ed903cb9b9c892d6f1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c717b20100ef8cd06b5237af70ea2cb692e058ce","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ff0ab535f8febbd32afa5832f8d2d9b06a8d5060","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6d29b91164424256a759ddabc8f2de1ae09bd3f1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"df262c828b616450eb351349e91c63447551bd01","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f2e291043c37a896d7f9797e25a356dceb030177","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c4086c6e1af757e1ff26fa2d2926b3ec0195de79","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/ata/ahci.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/533a08ea11217100cec7a0ed903cb9b9c892d6f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6d29b91164424256a759ddabc8f2de1ae09bd3f1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4086c6e1af757e1ff26fa2d2926b3ec0195de79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c717b20100ef8cd06b5237af70ea2cb692e058ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df262c828b616450eb351349e91c63447551bd01","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f2e291043c37a896d7f9797e25a356dceb030177","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff0ab535f8febbd32afa5832f8d2d9b06a8d5060","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97442","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.433","lastModified":"2026-10-03T11:17:55.873","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi\n\nIn certain cases, hardware might provide packets with a\nlength greater than the maximum native Wi-Fi header length.\nThis can lead to accessing and modifying fields in the header\nwithin the ath11k_dp_rx_h_undecap_nwifi() function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type and\npotentially result in invalid data access and memory corruption.\n\nKernel stack is corrupted in: ath11k_dp_rx_h_undecap+0x6b0/0x6b0 [ath11k]\nCall trace:\n ath11k_dp_rx_h_mpdu+0x0/0x2e8 [ath11k]\n ath11k_dp_rx_h_mpdu+0x1e0/0x2e8 [ath11k]\n ath11k_dp_rx_wbm_err+0x1e0/0x450 [ath11k]\n ath11k_dp_rx_process_wbm_err+0x2fc/0x460 [ath11k]\n ath11k_dp_service_srng+0x2e0/0x348 [ath11k]\n\nAdd a sanity check before processing the SKB to prevent invalid\ndata access in the undecap native Wi-Fi function for the\nDP_RX_DECAP_TYPE_NATIVE_WIFI decap type.\n\nThis adapted from the discussion/patch of the ath12k driver [1].\n\nTested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0c","versionType":"git","status":"affected"},{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"b4ef30f1d107aae460edf731a7c2d187fbc46a32","versionType":"git","status":"affected"},{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"1c0a13be76db3c1cf774aa11d9f4c3f8239ac567","versionType":"git","status":"affected"},{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"00738665c875ab34efa7126ea63c9d70b48ee169","versionType":"git","status":"affected"},{"version":"acc79d981c1462b22a7a2cb0d39725f8c01fc425","lessThan":"6b471e9aefee9ed73278eb1141e0d8530a56fae9","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/ath/ath11k/dp_rx.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/00738665c875ab34efa7126ea63c9d70b48ee169","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1c0a13be76db3c1cf774aa11d9f4c3f8239ac567","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b471e9aefee9ed73278eb1141e0d8530a56fae9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/958cf3696ddc5ccafd3d0b8b0c03d90bcd771c0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b4ef30f1d107aae460edf731a7c2d187fbc46a32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97443","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.550","lastModified":"2026-09-25T13:17:28.023","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/ftrace: Fix WARNING in __unregister_ftrace_function\n\nperf_ftrace_function_unregister() unconditionally calls\nunregister_ftrace_function() without checking whether the ftrace_ops\nwas ever successfully registered. This triggers a WARN_ON in\n__unregister_ftrace_function() when the ops doesn't have\nFTRACE_OPS_FL_ENABLED set.\n\nThis can happen during perf_event_alloc() error cleanup when\nperf_trace_destroy() is called via __free_event() on an event whose\nftrace_ops registration failed or was already torn down by\nperf_try_init_event()'s err_destroy path.\n\nThe call path is:\n  perf_event_alloc() error cleanup\n    -> __free_event()\n      -> event->destroy() [tp_perf_event_destroy]\n        -> perf_trace_destroy()\n          -> perf_trace_event_close()\n            -> TRACE_REG_PERF_CLOSE\n              -> perf_ftrace_function_unregister()\n                -> unregister_ftrace_function()\n                  -> __unregister_ftrace_function()\n                    -> WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED))\n\nFix this by checking FTRACE_OPS_FL_ENABLED before attempting to\nunregister. If the ops is not enabled, just free the filter and\nreturn success."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/trace/trace_event_perf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7ef5aa081f989ecfecc1df02068a80aebbd3ec31","lessThan":"df097713b56ffac5eed32a9be2e7d27ac48d9087","versionType":"git","status":"affected"},{"version":"c70ca298036c58a88686ff388d3d367e9d21acf0","lessThan":"7f845820afaad339341c2ae42bc7fdec175df9ea","versionType":"git","status":"affected"},{"version":"c70ca298036c58a88686ff388d3d367e9d21acf0","lessThan":"9581123304b23049437324038698af9fb56ee663","versionType":"git","status":"affected"},{"version":"315a50c6b1c6ce191f19f3372935d8e2ed9b53a6","versionType":"git","status":"affected"},{"version":"1209b0b29fd472e7dbd2b06544b019dd9f9b7e51","versionType":"git","status":"affected"},{"version":"6.12.24","lessThan":"6.12.111","versionType":"semver","status":"affected"},{"version":"6.13.12","lessThan":"6.14","versionType":"semver","status":"affected"},{"version":"6.14.3","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/trace/trace_event_perf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7f845820afaad339341c2ae42bc7fdec175df9ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9581123304b23049437324038698af9fb56ee663","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/df097713b56ffac5eed32a9be2e7d27ac48d9087","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97444","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.663","lastModified":"2026-10-03T11:17:56.017","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: add boundary checks in two places\n\nAdd boundary checks in acpi_ps_get_next_namestring() and\nacpi_ps_peek_opcode() to prevent out-of-bounds access."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/psargs.c","drivers/acpi/acpica/psparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3a8c1efc0fd3abb2d2b1254315f36db03abc88eb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c917df56b73719a2d4cee1c4ab4a6626acb95315","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4f03d84c95a51436878cd750a14f8ca37eeb3112","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"38ee32a9ace6fae8965f059b38e6e7fb27b1e7ce","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"253d7272d01db9529c79b95205c0f859ef9f4f23","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4de2cffef5e6b5b79eec8c934df582459b818228","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bdc35754012906dbf094be104b103ca3adfef6f7","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/psargs.c","drivers/acpi/acpica/psparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/253d7272d01db9529c79b95205c0f859ef9f4f23","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38ee32a9ace6fae8965f059b38e6e7fb27b1e7ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3a8c1efc0fd3abb2d2b1254315f36db03abc88eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4de2cffef5e6b5b79eec8c934df582459b818228","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f03d84c95a51436878cd750a14f8ca37eeb3112","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bdc35754012906dbf094be104b103ca3adfef6f7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c917df56b73719a2d4cee1c4ab4a6626acb95315","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97445","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.773","lastModified":"2026-10-03T11:17:56.153","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()\n\nEnhance buffer validation in acpi_ut_walk_aml_resources() to prevent\nbuffer overflows."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/utresrc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"816badec122fe01d05265f2d306212739f5d3fdb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cd60a407a3a6d75347a04f9271b7b561d06d21c8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"37c794f87a72471f7ef71633ac0550ad14ac0885","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"50a11e2f3dc8a7189e7ebbd3eeafa51f16128a56","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f65e2ef7ccca11dc874f48aff996a6a26528f8e7","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d0fb1973f705c8b8bd7e118e4a9a65d05d800fba","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/utresrc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/37c794f87a72471f7ef71633ac0550ad14ac0885","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/50a11e2f3dc8a7189e7ebbd3eeafa51f16128a56","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/816badec122fe01d05265f2d306212739f5d3fdb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2e21fe8c3361c3d0d57ee56d359bea9b51fda3d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cd60a407a3a6d75347a04f9271b7b561d06d21c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0fb1973f705c8b8bd7e118e4a9a65d05d800fba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f65e2ef7ccca11dc874f48aff996a6a26528f8e7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97446","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.880","lastModified":"2026-10-03T11:17:56.300","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()\n\nacpi_ns_custom_package() unconditionally dereferences the first element\nof the package to read the _BIX version number, without checking for\nNULL:\n\n    if ((*Elements)->Common.Type != ACPI_TYPE_INTEGER)\n\nWhen firmware returns a _BIX package whose first element is an\nunresolvable reference, ACPICA evaluates that entry to NULL.\nacpi_ns_remove_null_elements() does not strip NULL entries for\nACPI_PTYPE_CUSTOM packages (fixed-position format would break if\nelements were shifted), so acpi_ns_custom_package() sees the NULL\nand causes a crash.\n\nAdd a NULL check for the first element (version field) before\ndereferencing it. The caller then receives AE_AML_OPERAND_TYPE\ninstead of crashing."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/nsprepkg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"fad537538cdfcdc51e41db61bbf9ebe5ed9427eb","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"9936507ac0f2379787a2a805b11ab1cf0f241372","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"644888605f55395e6012ed43e3ed643ef7ab5013","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"08c5dee5da1d8d99b5a4e94db5a3d873c491771e","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"3762c6c8ae5073892d7cec736cc54270c7c9ce90","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"3cbf096a478f4fa03953f0685ad28c9c82ce67cb","versionType":"git","status":"affected"},{"version":"7952d40240855932de01bbe81c02bf1416ec91d8","lessThan":"f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/nsprepkg.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.7","status":"affected"},{"version":"0","lessThan":"4.7","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/08c5dee5da1d8d99b5a4e94db5a3d873c491771e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3762c6c8ae5073892d7cec736cc54270c7c9ce90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3cbf096a478f4fa03953f0685ad28c9c82ce67cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/644888605f55395e6012ed43e3ed643ef7ab5013","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9936507ac0f2379787a2a805b11ab1cf0f241372","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8d14b7bb0063bbbd86c0e4d73edb8cea7b362bc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fad537538cdfcdc51e41db61bbf9ebe5ed9427eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97447","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:22.993","lastModified":"2026-09-25T13:17:28.510","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()\n\nEnhance OEM ID and Table ID validation in acpi_ex_load_table_op() to\nprevent buffer overflows."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/exconfig.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ebf27765421c9238b7835d32a95e4a7fb8db26a4","lessThan":"d15c574022e0944f651759f567a9eef61e7b93ca","versionType":"git","status":"affected"},{"version":"ebf27765421c9238b7835d32a95e4a7fb8db26a4","lessThan":"485829e6999b7909f50761a1c708660304edc945","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/exconfig.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/485829e6999b7909f50761a1c708660304edc945","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d15c574022e0944f651759f567a9eef61e7b93ca","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97448","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.110","lastModified":"2026-10-03T11:17:56.417","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Add validation for node in acpi_ns_build_normalized_path()\n\nAdd validation for node in acpi_ns_build_normalized_path()\nto prevent use-after-free vulnerabilities."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/nsnames.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"087eed8b347e14864f8806fa1f5976c7dc2c6792","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"b06bb9b82c8f9a522dde213b1e0ddd535f22e3a2","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"90ebe7f8bb6ca1c6eadb16bed141ab8bb3dbab70","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"26dd27000e9540fcb594f15010b0696b03b0d240","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"babb146ceb79e71f328788f1e2c8c7c224026e61","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"21a73528579fcbd673b668bd27a05b658123bc1b","versionType":"git","status":"affected"},{"version":"d1e7ffe50ba588ddf7de520990815c37f31776d8","lessThan":"96b2b616870e46e2bc04efec03879683a0036e66","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/nsnames.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.3","status":"affected"},{"version":"0","lessThan":"4.3","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/087eed8b347e14864f8806fa1f5976c7dc2c6792","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21a73528579fcbd673b668bd27a05b658123bc1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/26dd27000e9540fcb594f15010b0696b03b0d240","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/90ebe7f8bb6ca1c6eadb16bed141ab8bb3dbab70","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/96b2b616870e46e2bc04efec03879683a0036e66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b06bb9b82c8f9a522dde213b1e0ddd535f22e3a2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/babb146ceb79e71f328788f1e2c8c7c224026e61","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97449","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.230","lastModified":"2026-10-03T11:17:56.557","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Add package limit checks in parser functions\n\nAdd package limit checks in parser functions to prevent out-of-bounds\naccess."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/nsxfname.c","drivers/acpi/acpica/psargs.c","drivers/acpi/acpica/psloop.c","drivers/acpi/acpica/psparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c82d4adeeb5acbd5231f082da11155017a4c241e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7beb63a99f43c090ec235e44773bd906b3fded9f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"55594743fb6935d046cb6ce1e9f588828b43f3e9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2442772fd79a440c067936f307c4948c570d6f81","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"250800658bf3db32e7accc615b0a134c30fba203","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1cac04312b77fb81209da13bf5e0b83962568fcb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d27d48a528e437aed690f977e69a6fe73fe82ab5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/nsxfname.c","drivers/acpi/acpica/psargs.c","drivers/acpi/acpica/psloop.c","drivers/acpi/acpica/psparse.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1cac04312b77fb81209da13bf5e0b83962568fcb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2442772fd79a440c067936f307c4948c570d6f81","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/250800658bf3db32e7accc615b0a134c30fba203","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/55594743fb6935d046cb6ce1e9f588828b43f3e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7beb63a99f43c090ec235e44773bd906b3fded9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c82d4adeeb5acbd5231f082da11155017a4c241e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d27d48a528e437aed690f977e69a6fe73fe82ab5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97450","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.350","lastModified":"2026-10-03T11:17:56.667","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: validate handler object type in two places\n\nACPICA: validate handler object type in acpi_ev_has_default_handler()\nand acpi_ev_find_region_handler()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/evhandler.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7af2da201623ab5bc0773bd3eeb2f2345cfa1c4a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9d9fbf6b895a23238e4a7b1a3230f648f0d952a1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e98825650c2eb1605c707fd1391ceed65bb8e481","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"254e304f68dc079906ce2df4723548ffe35f682a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bfd981d35ed3156414fd35b4fe311d5d25cbfca6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4c977d57a784682dc8c6cce2f9253ef44ec28ae8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c5296da2d516707862f8a2dbb4b515f777e5294f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/evhandler.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/254e304f68dc079906ce2df4723548ffe35f682a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c977d57a784682dc8c6cce2f9253ef44ec28ae8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7af2da201623ab5bc0773bd3eeb2f2345cfa1c4a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d9fbf6b895a23238e4a7b1a3230f648f0d952a1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfd981d35ed3156414fd35b4fe311d5d25cbfca6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c5296da2d516707862f8a2dbb4b515f777e5294f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e98825650c2eb1605c707fd1391ceed65bb8e481","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97451","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.463","lastModified":"2026-10-03T11:17:56.810","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)\n\nAdd overflow check for Index + Length to prevent integer overflow\nwhen calculating the truncation length. This prevents negative\nsize parameter being passed to memcpy()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/exoparg3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6da963ed4c3de0963c23809af3194323328080d2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e539003886b34c8109574820b9ba67f0dbe62a12","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9010ad440f970e684324d507510415a67bc125e4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4532c9cf006bb6323957897455b6a5ab45957a19","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d0d89f2e16a874e0f8fb17045da293e8bedf8b21","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b96401812cbfbb4803faabeefa1f20b8562268b3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0e2021f49e64b3c8a9aa880d0c62a218bfe147ce","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/exoparg3.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e2021f49e64b3c8a9aa880d0c62a218bfe147ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4532c9cf006bb6323957897455b6a5ab45957a19","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6da963ed4c3de0963c23809af3194323328080d2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9010ad440f970e684324d507510415a67bc125e4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b96401812cbfbb4803faabeefa1f20b8562268b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0d89f2e16a874e0f8fb17045da293e8bedf8b21","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e539003886b34c8109574820b9ba67f0dbe62a12","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97452","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.573","lastModified":"2026-10-03T11:17:56.963","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Prevent adding invalid references\n\nPrevent adding references for local, argument, and debug objects\nin acpi_ut_copy_simple_object()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/utcopy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2350a6f89eca45f9219f37b331e4083f96299996","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"61cb905c33d0e0c6ff3c9c90fb269331bce8c2c0","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d239ccf5069f892cc36b9befafda030b3ca789e6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c2cf936b07b0a298637e56e53ef043c7ff8eee31","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e16d1e5fcb17dfc369e20095f8cf5e841101279e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6e8c55e13a5e3a9f38921d62924f18ceba3330eb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/utcopy.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2350a6f89eca45f9219f37b331e4083f96299996","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61cb905c33d0e0c6ff3c9c90fb269331bce8c2c0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e8c55e13a5e3a9f38921d62924f18ceba3330eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a6cd2fc2d5429a5b7d5a8b9ba0e6663e8ccbc9ba","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2cf936b07b0a298637e56e53ef043c7ff8eee31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d239ccf5069f892cc36b9befafda030b3ca789e6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e16d1e5fcb17dfc369e20095f8cf5e841101279e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97453","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.710","lastModified":"2026-10-03T11:17:57.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: validate byte_count in acpi_ps_get_next_package_length()\n\nValidate package length reading in acpi_ps_get_next_package_length()."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/psargs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6b9904fc65d82bea4922a33038d075488954bcc9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"802f83e628b8fa6106428ef05d3fb03f99816fd6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"37e60db04eed9d6c5801d63f99cfd3af99b9a2c8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6e0d26e6ec90340533722214b7a923521f91caa2","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"780f380c66b80030379bec65bb1bd09ce6f6d9fc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"9bc0e8c3df689765ad5161eb3aed15de8544f5ce","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d49c6ee08365a8596f639da46eb7e71752b0cd42","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/psargs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/37e60db04eed9d6c5801d63f99cfd3af99b9a2c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6b9904fc65d82bea4922a33038d075488954bcc9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e0d26e6ec90340533722214b7a923521f91caa2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/780f380c66b80030379bec65bb1bd09ce6f6d9fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/802f83e628b8fa6106428ef05d3fb03f99816fd6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9bc0e8c3df689765ad5161eb3aed15de8544f5ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d49c6ee08365a8596f639da46eb7e71752b0cd42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97454","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.823","lastModified":"2026-10-03T11:17:57.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: add boundary checks in acpi_ps_get_next_field()\n\nAdd boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds\naccess."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/psargs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1d704a9ba665f8d1598fc6f37a76cbd6547cdcb1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6ecf2a4855a728c4c46e33919fea9480052d62a7","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6509f56df51235fe447b624e40c098082717625c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7d97ecf2a4c7a77a9daa3fe76790ddecddc9cd0c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"add715fc1ef5b0a71afe22b3f02aa28775d9ba62","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bc5b2158c7626e3e8a78c5bb93ce0a734a26b84a","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e15aa60de0256d63df2331bf5a4bc4dd287504cd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/psargs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/1d704a9ba665f8d1598fc6f37a76cbd6547cdcb1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6509f56df51235fe447b624e40c098082717625c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ecf2a4855a728c4c46e33919fea9480052d62a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d97ecf2a4c7a77a9daa3fe76790ddecddc9cd0c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/add715fc1ef5b0a71afe22b3f02aa28775d9ba62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc5b2158c7626e3e8a78c5bb93ce0a734a26b84a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e15aa60de0256d63df2331bf5a4bc4dd287504cd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97455","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:23.957","lastModified":"2026-10-03T11:17:57.370","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix use-after-free in acpi_ds_terminate_control_method()\n\nFix use-after-free issue in acpi_ds_terminate_control_method() by\nclearing references to method locals and arguments."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/dsmethod.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"460aed7b408508a2c28ca4fdd8d90a82bb4005aa","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3855d8992f5a88b033925cc4f6aef7a485f326cb","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2793b1c38f0053fd9b119ce4607dd056eb05d382","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"63ca6f67816a229e07a08cac4bef1b3858abde66","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fe7b3d3b7490c2c0119f2d84fa33996dcbc71042","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ef5a8d939c1e5b36e75450bbb5b6348faff4dcf3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"945e87267cfd90937b3c637f87324cbb56998b72","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/dsmethod.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/2793b1c38f0053fd9b119ce4607dd056eb05d382","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3855d8992f5a88b033925cc4f6aef7a485f326cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/460aed7b408508a2c28ca4fdd8d90a82bb4005aa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/63ca6f67816a229e07a08cac4bef1b3858abde66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/945e87267cfd90937b3c637f87324cbb56998b72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ef5a8d939c1e5b36e75450bbb5b6348faff4dcf3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe7b3d3b7490c2c0119f2d84fa33996dcbc71042","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97456","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.127","lastModified":"2026-10-03T11:17:57.507","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nACPICA: Fix condition check in acpi_ps_parse_loop()\n\nFix condition check for AML_ELSE_OP in acpi_ps_parse_loop() to prevent\nout-of-bounds access."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/acpi/acpica/psloop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"c838d32fbe02a6d426aebf95d2aef97de92ddc43","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"b79f5cb2131956a7d2c99870336d9fcc6db80c4b","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"de2bbc8dbe7048f20f0a783a81e712fd3664de5b","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"4c22c9842c53b824743bdf1d8d19e1cdb908f82e","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"a477c6ef5335d2d0613ff7c1779a8209f16627c5","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"5d16f40b019e59df81deb594ed4eafefc8e43cc0","versionType":"git","status":"affected"},{"version":"5088814a6e931350e5bd29f5d59fa40c6dbbdf10","lessThan":"8de27e2d83c0d07ae9443c6304575b0609394bfd","versionType":"git","status":"affected"},{"version":"2e78935d1e27d31955ad2dad4abe6c453cf669fd","versionType":"git","status":"affected"},{"version":"4.17.3","lessThan":"4.18","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/acpi/acpica/psloop.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.18","status":"affected"},{"version":"0","lessThan":"4.18","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4c22c9842c53b824743bdf1d8d19e1cdb908f82e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5d16f40b019e59df81deb594ed4eafefc8e43cc0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8de27e2d83c0d07ae9443c6304575b0609394bfd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a477c6ef5335d2d0613ff7c1779a8209f16627c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b79f5cb2131956a7d2c99870336d9fcc6db80c4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c838d32fbe02a6d426aebf95d2aef97de92ddc43","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de2bbc8dbe7048f20f0a783a81e712fd3664de5b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97472","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.273","lastModified":"2026-10-03T11:17:57.617","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: addrconf: fix temp address generation after prefix deprecation\n\nWhen a router temporarily deprecates an IPv6 prefix (either by sending a\nRouter Advertisement with Preferred Lifetime = 0 or by letting the\nlifetime expire) and later restores it, the kernel permanently loses its\nability to generate temporary privacy addresses (RFC 8981) for that\nprefix.\n\nThis happens because the address worker attempts to generate a\nreplacement temporary address when the current one nears expiration. As\nthe base prefix is deprecated already, the generation fails after\nmarking the temporary address as already having spawned a replacement\n(ifp->regen_count++).\n\nWhen the router eventually restores the prefix, the temporary address\nbecomes active again. However, once it naturally expires, the address\nworker sees this temporary address already tried to generate one and\nskips the regeneration.\n\nFix the issue by resetting the regen_count check of the latest temp\naddress generated for the prefix updated by the incoming RA."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/ipv6/addrconf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"b00f7c1da82a809156f785ed37536c2d2584927d","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"6da8ba900b85e6478e211427630c67595fb707a4","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"4f7d2a8dc364c4e55d0a1533451339008512933f","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"f601ec5c92b3260c742f27a5d2fd289e30ae798f","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"bff7b87dfa28a1502c18d0c6f1fadda5162fa854","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"4df5597c65446135362f72880995e8920f058fa0","versionType":"git","status":"affected"},{"version":"76f793e3a47139d340185cbc1a314740c09b13d3","lessThan":"e20d8922aa8fe441d291364c96c2179a005b79ea","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/ipv6/addrconf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.2","status":"affected"},{"version":"0","lessThan":"3.2","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/4df5597c65446135362f72880995e8920f058fa0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f7d2a8dc364c4e55d0a1533451339008512933f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6da8ba900b85e6478e211427630c67595fb707a4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b00f7c1da82a809156f785ed37536c2d2584927d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bff7b87dfa28a1502c18d0c6f1fadda5162fa854","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e20d8922aa8fe441d291364c96c2179a005b79ea","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f601ec5c92b3260c742f27a5d2fd289e30ae798f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97473","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.390","lastModified":"2026-09-28T06:16:33.170","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()\n\nWhen topology_physical_package_id()/topology_logical_die_id() returns\na negative value, rapl_add_package_cpuslocked() returns ERR_PTR(-EINVAL)\ndirectly without freeing the rapl_package structure that was just\nallocated by kzalloc_obj(), leaking memory on every failed package\naddition.\n\nUse the existing err_free_package label so that the allocation is\nreleased on the error path."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/powercap/intel_rapl_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"26096aed255fbac9501718174dbb24c935d8854e","lessThan":"3e9e9337e03be946ec93f2c9d28dab242482be1b","versionType":"git","status":"affected"},{"version":"26096aed255fbac9501718174dbb24c935d8854e","lessThan":"992c60771749d8d8cbfbd06049785fff95c72df1","versionType":"git","status":"affected"},{"version":"26096aed255fbac9501718174dbb24c935d8854e","lessThan":"bfc7d93bc5e12288e5dc6bb54260f68cdf5a5c47","versionType":"git","status":"affected"},{"version":"f8a7fa068be099fe3406178ab047cba7c8456203","versionType":"git","status":"affected"},{"version":"f575a20bd53ea755800e79c2b7aea20e9b0b2242","versionType":"git","status":"affected"},{"version":"6.10.12","lessThan":"6.11","versionType":"semver","status":"affected"},{"version":"6.11.1","lessThan":"6.12","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/powercap/intel_rapl_common.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.12","status":"affected"},{"version":"0","lessThan":"6.12","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3e9e9337e03be946ec93f2c9d28dab242482be1b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/992c60771749d8d8cbfbd06049785fff95c72df1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfc7d93bc5e12288e5dc6bb54260f68cdf5a5c47","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97474","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.547","lastModified":"2026-09-28T06:16:33.277","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mld: purge async notifications upon nic error\n\nThis fixes a kernel panic in reconfig failure:\n\n1. we have a BSS connection\n2. we have a NAN connection\n3. FW error occurs\n4. reconfig restores the BSS connection\n5. however, restoring the NAN connection fails due to a FW error.\n6. erroneously, ieee80211_handle_reconfig_failure is called and marks all\n   interfaces as not-in-driver (will be fixed in a different patch).\n7. mac80211 frees the links of the BSS connection but doesn't tell the\n   driver about that, as it thinks that this vif is not in the driver.\n8. in ieee80211_stop_device, *ALL* wiphy works are getting flushed\n   (erroneously?)\n9. Therefore, async_handlers_wk is being executed, processing the\n   statistics notification that was received after we restored the BSS\n   connection.\n10. the notification handler dereferences fw_id_to_bss_conf[id], which is\n    now a dangling pointer, as mac80211 already freed this link in (7).\n11. On the first access to one of the links fields, we panic.\n\nWhile this can and should be fixed by removing the call to\nieee80211_handle_reconfig_failure in (6), it is also not a good idea to\ncarry and maybe handle notifications from a dead FW.\n\nWe do purge the notifications when we stop the FW, but in reconfig\nfailure we stop the FW too late, after the notifications are processed.\nIn addition, async_handlers_wk can always be scheduled before the\nreconfig work.\n\nPurge the notifications immediately when transport notifies about a nic\nerror."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/mld.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"1b3b7b521041d55459f8457db8921e9778482063","versionType":"git","status":"affected"},{"version":"d1e879ec600f9b3bdd253167533959facfefb17b","lessThan":"a40ad60a47f7c904b75a9ff83b39edebf3961c85","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/intel/iwlwifi/mld/mld.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.4,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/1b3b7b521041d55459f8457db8921e9778482063","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a40ad60a47f7c904b75a9ff83b39edebf3961c85","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97475","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.800","lastModified":"2026-10-03T11:17:57.737","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthermal/drivers/tegra/soctherma: Switch to devm cooling device registration\n\nUse devm_thermal_of_cooling_device_register() to simplify resource\nmanagement and avoid manual cleanup in error paths.\n\nAs a side effect this change has the benefit of solving an existing\nissue. Before, the function tegra_soctherm_remove() only called\ndebugfs_remove_recursive() and never called thermal_cooling_device_unregister()\nfor any of the cooling devices registered here.\n\nAfter the driver removal, the thermal framework's cdev list would\nstill hold references to thermal_cooling_device objects whose devdata\npointer (ts) pointed to memory already freed by the platform device's\ndevm cleanup.\n\nWith this change, the cooling device is unregistered when the driver\nis removed, thus fixing the issue above."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thermal/tegra/soctherm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"78a2ba09fd7501df09239c7e3c311c80c259ed31","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"0c65f786a69402620306828aa19817fd71f37f4b","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"e777ab46db8c2addffe801274d713252318ef750","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"a643ce49ddcdbdec173e7bbf4c32c897e0293ba9","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"6f2a863e7e9adf6088fe644259576181e60ee5e5","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"deaeb7be8e6b04c8b71080acba1bd88698f56b1d","versionType":"git","status":"affected"},{"version":"ce0dbf04f685d48ffdec64a17ebb4965f828c3ff","lessThan":"ee126267bc04bfb03816ae9d71ca24c5bf99e739","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thermal/tegra/soctherm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0c65f786a69402620306828aa19817fd71f37f4b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6f2a863e7e9adf6088fe644259576181e60ee5e5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78a2ba09fd7501df09239c7e3c311c80c259ed31","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a643ce49ddcdbdec173e7bbf4c32c897e0293ba9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/deaeb7be8e6b04c8b71080acba1bd88698f56b1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e777ab46db8c2addffe801274d713252318ef750","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee126267bc04bfb03816ae9d71ca24c5bf99e739","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97476","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:24.933","lastModified":"2026-10-03T11:17:57.857","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: filter RDS_INFO_* getsockopt by caller's netns\n\nThe RDS_INFO_* family of getsockopt(2) options reads several\nfile-scope global lists that are not per-netns:\n\n  rds_sock_info / rds6_sock_info,\n  rds_sock_inc_info / rds6_sock_inc_info        -> rds_sock_list\n  rds_tcp_tc_info / rds6_tcp_tc_info            -> rds_tcp_tc_list\n  rds_conn_info / rds6_conn_info,\n  rds_conn_message_info_cmn (for the *_SEND_MESSAGES and\n  *_RETRANS_MESSAGES variants),\n  rds_for_each_conn_info (for RDS_INFO_IB_CONNECTIONS)\n                                                -> rds_conn_hash[]\n\nThe handlers do not filter by the caller's network namespace.\nrds_info_getsockopt() has no netns or capable() check, and\nrds_create() has no capable() check, so AF_RDS is reachable from\nan unprivileged user namespace. As a result, an unprivileged\ncaller in a fresh user_ns plus netns can read the bound address\nand sock inode of every RDS socket on the host, the peer address\nof incoming messages on every RDS socket on the host, the peer\naddress and TCP sequence numbers of every rds-tcp connection on\nthe host, and the peer address and RDS sequence numbers of every\nRDS connection on the host.\n\nThe rds-tcp transport is reachable from a non-initial netns (see\nrds_set_transport()), so a one-shot init_net gate at\nrds_info_getsockopt() would deny legitimate per-netns visibility\nto rds-tcp callers. Instead, filter at each handler by comparing\nthe netns of the caller's socket to the netns of the list entry,\nor to rds_conn_net(conn) for connection paths. Only copy entries\nwhose netns matches the caller. Counters (RDS_INFO_COUNTERS) are\naggregate statistics and remain global.\n\nReproducer (KASAN VM, rds and rds_tcp loaded): an AF_RDS socket\nbinds 127.0.0.1:4242 in init_net as root. A child process enters\na fresh user_ns plus netns and opens AF_RDS there, then calls\ngetsockopt(SOL_RDS, RDS_INFO_SOCKETS). Before this change, the\nchild sees the init_net socket. After this change, the child\nsees zero entries.\n\nDrop the rds_sock_count, rds_tcp_tc_count, and rds6_tcp_tc_count\nglobals. v2 used them for the size precheck and lens->nr; v3\nreplaced the precheck with a per-ns count from a first pass over\nthe list, so the globals have no remaining readers. The matching\nincrements and decrements in rds_create()/rds_destroy_sock() and\nrds_tcp_set_callbacks()/rds_tcp_restore_callbacks() go away with\nthem. Reported by the kernel test robot under clang W=1."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/af_rds.c","net/rds/connection.c","net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"64ca5839916176c3451f61a2c7178033423c67d7","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"8b04dda272c30d46834bb03dd2895b08c090483b","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"f05142d0eeaa6e8227511c88e10a2b8fe7a78fc4","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"65fae4b42269dbea7e3842ae4dd0786162c6248e","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"093f172296d32499ffac7809629b206178776eb6","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"c4081e49ebe0e3160c4b70ec7639494792dee206","versionType":"git","status":"affected"},{"version":"639b321b4d8f4e412bfbb2a4a19bfebc1e68ace4","lessThan":"c96a5209dda666004b8ee1ed7f0d493d09a4f200","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/af_rds.c","net/rds/connection.c","net/rds/tcp.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/093f172296d32499ffac7809629b206178776eb6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64ca5839916176c3451f61a2c7178033423c67d7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/65fae4b42269dbea7e3842ae4dd0786162c6248e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b04dda272c30d46834bb03dd2895b08c090483b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c4081e49ebe0e3160c4b70ec7639494792dee206","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c96a5209dda666004b8ee1ed7f0d493d09a4f200","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f05142d0eeaa6e8227511c88e10a2b8fe7a78fc4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97477","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.063","lastModified":"2026-10-21T13:21:10.067","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()\n\nWhen __rdma_counter_bind_qp() fails in alloc_and_bind(), the error path\njumps to err_mode which frees the counter without decrementing\nport_counter->num_counters. The only place that decrements is\nrdma_counter_free(), which is unreachable since the counter was never\nsuccessfully bound.\n\nThis leak accumulates across repeated failures, permanently preventing\nthe port from switching to AUTO mode (-EBUSY in __counter_set_mode())\nand blocking the MANUAL→NONE auto-revert in rdma_counter_free(). When\nthe mode was NONE before the call, the MANUAL mode set by\n__counter_set_mode() also leaks since the revert logic is never\nreached.\n\nAdd an err_bind label between the num_counters increment and the\nexisting err_mode label. It decrements num_counters and mirrors the\nMANUAL→NONE revert from rdma_counter_free(), ensuring the port state\nis fully restored on bind failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/infiniband/core/counters.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8bc205eff3056a9ed3850937cdd2192f05e6d3cb","lessThan":"7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2a","versionType":"git","status":"affected"},{"version":"8bc205eff3056a9ed3850937cdd2192f05e6d3cb","lessThan":"1bcdeddddffadff9993657f6b0e5535d66ebd10f","versionType":"git","status":"affected"},{"version":"8bc205eff3056a9ed3850937cdd2192f05e6d3cb","lessThan":"da95cb016812c0e012ea839f191926e35ca8f57f","versionType":"git","status":"affected"},{"version":"8bc205eff3056a9ed3850937cdd2192f05e6d3cb","lessThan":"4fbc8230009f5b1bcd13cc74c5a6a43ddba141fd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/infiniband/core/counters.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.11","status":"affected"},{"version":"0","lessThan":"5.11","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1bcdeddddffadff9993657f6b0e5535d66ebd10f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4fbc8230009f5b1bcd13cc74c5a6a43ddba141fd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c9fee40fc8d8d928f44e99bc6e6adf93f9f2c2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da95cb016812c0e012ea839f191926e35ca8f57f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97478","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.183","lastModified":"2026-10-21T13:21:10.193","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirt: acrn: Fix irqfd use-after-free during eventfd shutdown\n\nacrn_irqfd_deassign() and the eventfd EPOLLHUP wakeup can race and free\nthe same struct hsm_irqfd:\n\n  CPU0                                 CPU1\n  ----                                 ----\n  eventfd_release()\n    wake_up_poll(EPOLLHUP)\n      hsm_irqfd_wakeup()\n        queue_work(&irqfd->shutdown)\n                                       acrn_irqfd_deassign()\n                                         hsm_irqfd_shutdown()\n                                           list_del_init()\n                                           eventfd_ctx_remove_wait_queue()\n                                           eventfd_ctx_put()\n                                         kfree(irqfd)\n  hsm_irqfd_shutdown_work()\n    container_of(work, ..., shutdown)\n    irqfd->vm                  <-- use-after-free\n\nThe deassign path freed the irqfd while a shutdown work item was\nalready queued by EPOLLHUP (or vice versa), so the work item could\nresurrect a dangling pointer through container_of().\n\nSwitch to the lifetime model used by KVM irqfds:\n\n - Deassign/deinit only deactivate the irqfd: remove it from vm->irqfds\n   under irqfds_lock and queue the cleanup work.\n - hsm_irqfd_shutdown_work() becomes the sole owner that unhooks the\n   eventfd waitqueue entry, drops the eventfd reference and frees the\n   irqfd.\n - A new HSM_IRQFD_FLAG_SHUTDOWN bit guarded by test_and_set_bit()\n   ensures the cleanup work is queued at most once, no matter how many\n   of {EPOLLHUP, deassign, deinit} fire concurrently.  This is safe to\n   call from the waitqueue callback, which runs with wqh->lock held and\n   IRQs disabled and therefore cannot take irqfds_lock.\n - acrn_irqfd_deassign() flushes vm->irqfd_wq before returning so the\n   eventfd is fully detached on return.  acrn_irqfd_deinit() deactivates\n   every irqfd, flushes the workqueue and only then destroys it, so no\n   path can queue_work() onto a torn-down workqueue.\n - acrn_irqfd_assign() now installs the eventfd waitqueue entry and\n   publishes the irqfd to vm->irqfds under irqfds_lock, so the irqfd is\n   never visible to deassign/deinit before its waitqueue entry is in\n   place, and any EPOLLHUP that fires in the assign window queues\n   cleanup work that blocks on irqfds_lock until publication is done."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/virt/acrn/irqfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"aa3b483ff1d71c50b33db154048dff9a8f08ac71","lessThan":"6e9e007ee1dfb54bc2d070550308077ec28dbaec","versionType":"git","status":"affected"},{"version":"aa3b483ff1d71c50b33db154048dff9a8f08ac71","lessThan":"0e1152f689847b9db2f05454775d34610c1424c2","versionType":"git","status":"affected"},{"version":"aa3b483ff1d71c50b33db154048dff9a8f08ac71","lessThan":"d8156aacfcabb81f52c20ef89094945434d08079","versionType":"git","status":"affected"},{"version":"aa3b483ff1d71c50b33db154048dff9a8f08ac71","lessThan":"666c7f9e07925aa0863348f960e09bb89f8f05a3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/virt/acrn/irqfd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/0e1152f689847b9db2f05454775d34610c1424c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/666c7f9e07925aa0863348f960e09bb89f8f05a3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e9e007ee1dfb54bc2d070550308077ec28dbaec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d8156aacfcabb81f52c20ef89094945434d08079","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97479","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.337","lastModified":"2026-10-21T13:21:10.423","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: Avoid warning when removing a device while its supplier is unbinding\n\nDuring driver removal, the following warning can appear:\n   WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc\n   ...\n   Call trace:\n     __device_links_no_driver+0xcc/0xfc (P)\n     device_links_driver_cleanup+0xa8/0xf0\n     device_release_driver_internal+0x208/0x23c\n     device_links_unbind_consumers+0xe0/0x108\n     device_release_driver_internal+0xec/0x23c\n     device_links_unbind_consumers+0xe0/0x108\n     device_release_driver_internal+0xec/0x23c\n     device_links_unbind_consumers+0xe0/0x108\n     device_release_driver_internal+0xec/0x23c\n     driver_detach+0xa0/0x12c\n     bus_remove_driver+0x6c/0xbc\n     driver_unregister+0x30/0x60\n     pci_unregister_driver+0x20/0x9c\n     lan966x_pci_driver_exit+0x18/0xa90 [lan966x_pci]\n\nThis warning is triggered when a consumer is removed because the links\nstatus of its supplier is not DL_DEV_DRIVER_BOUND and the link flag\nDL_FLAG_SYNC_STATE_ONLY is not set.\n\nThe topology in terms of consumers/suppliers used was the following\n(consumer ---> supplier):\n\n      i2c -----------> OIC ----> PCI device\n       |                ^\n       |                |\n       +---> pinctrl ---+\n\nWhen the PCI device is removed, the OIC (interrupt controller) has to be\nremoved. In order to remove the OIC, pinctrl and i2c need to be removed\nand to remove pinctrl, i2c need to be removed. The removal order is:\n  1) i2c\n  2) pinctrl\n  3) OIC\n  4) PCI device\n\nIn details, the removal sequence is the following (with 0000:01:00.0 the\nPCI device):\n  driver_detach: call device_release_driver_internal(0000:01:00.0)...\n    device_links_busy(0000:01:00.0):\n      links->status = DL_DEV_UNBINDING\n    device_links_unbind_consumers(0000:01:00.0):\n      0000:01:00.0--oic link->status = DL_STATE_SUPPLIER_UNBIND\n      call device_release_driver_internal(oic)...\n        device_links_busy(oic):\n          links->status = DL_DEV_UNBINDING\n        device_links_unbind_consumers(oic):\n          oic--pinctrl link->status = DL_STATE_SUPPLIER_UNBIND\n          call device_release_driver_internal(pinctrl)...\n            device_links_busy(pinctrl):\n              links->status = DL_DEV_UNBINDING\n            device_links_unbind_consumers(pinctrl):\n              pinctrl--i2c link->status = DL_STATE_SUPPLIER_UNBIND\n              call device_release_driver_internal(i2c)...\n                device_links_busy(i2c): links->status = DL_DEV_UNBINDING\n                __device_links_no_driver(i2c)...\n                  pinctrl--i2c link->status is DL_STATE_SUPPLIER_UNBIND\n                  oic--i2c link->status is DL_STATE_ACTIVE\n                  oic--i2c link->supplier->links.status is DL_DEV_UNBINDING\n\nThe warning is triggered by the i2c removal because the OIC (supplier)\nlinks status is not DL_DEV_DRIVER_BOUND. Its links status is indeed set\nto DL_DEV_UNBINDING.\n\nIt is perfectly legit to have the links status set to DL_DEV_UNBINDING\nin that case. Indeed we had started to unbind the OIC which triggered\nthe consumer unbinding and didn't finish yet when the i2c is unbound.\n\nAvoid the warning when the supplier links status is set to\nDL_DEV_UNBINDING and thus support this removal sequence without any\nwarnings."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/base/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"8c3e315d4296421cd26b3300ee0ac117f0877f20","lessThan":"d5eb39d6178ca88db706c7b82dcd19a77f30aa9e","versionType":"git","status":"affected"},{"version":"8c3e315d4296421cd26b3300ee0ac117f0877f20","lessThan":"da22e4bce2a8cbed32dcda407b7d06cb5feec8e3","versionType":"git","status":"affected"},{"version":"8c3e315d4296421cd26b3300ee0ac117f0877f20","lessThan":"73ea4ec0ec46d12558a61842b474e7dd63538edc","versionType":"git","status":"affected"},{"version":"8c3e315d4296421cd26b3300ee0ac117f0877f20","lessThan":"36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9","versionType":"git","status":"affected"},{"version":"2e5c082d3727522a3f30a50582784d24754d14a8","versionType":"git","status":"affected"},{"version":"70154bb515a325c007bcf64971099e1e17f16f28","versionType":"git","status":"affected"},{"version":"5.6.19","lessThan":"5.7","versionType":"semver","status":"affected"},{"version":"5.7.3","lessThan":"5.8","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/base/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.8","status":"affected"},{"version":"0","lessThan":"5.8","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/36d74f17e03f7e60e1b08fbe16cfad6e69cc3aa9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/73ea4ec0ec46d12558a61842b474e7dd63538edc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5eb39d6178ca88db706c7b82dcd19a77f30aa9e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da22e4bce2a8cbed32dcda407b7d06cb5feec8e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97480","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.467","lastModified":"2026-10-21T13:21:10.583","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: 8250: protect against NULL uart->port.dev in register\n\nserial8250_register_8250_port() conditionally copies uart->port.dev\nfrom up->port.dev only when up->port.dev is non-NULL:\n\n\tif (up->port.dev) {\n\t\tuart->port.dev = up->port.dev;\n\t\t...\n\t}\n\nSo if both the existing uart slot and up have a NULL ->dev,\nuart->port.dev remains NULL. The very next ACPI companion check\nthen dereferences it unconditionally:\n\n\tif (!has_acpi_companion(uart->port.dev)) {\n\nhas_acpi_companion() reads dev->fwnode without a NULL guard\n(include/linux/acpi.h), so this NULL-derefs the kernel for the\nremaining no-dev case rather than just skipping the\nmctrl_gpio_init() initialisation as intended.\n\nsmatch flags the inconsistency:\n\n  drivers/tty/serial/8250/8250_core.c:767\n  serial8250_register_8250_port() error: 'uart->port.dev' could be\n  null (see line 719)\n\nGuard the call with a NULL check so register continues to work\nfor callers that legitimately have no parent device (legacy\nnon-OF/non-ACPI registrations).\n\nNo functional change for callers that pass a non-NULL ->dev."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/tty/serial/8250/8250_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4a96895f74c9633b51427fd080ab70fa62b65bc4","lessThan":"68059b6e9f7292714286e2b0f5185ed2a43fccc5","versionType":"git","status":"affected"},{"version":"4a96895f74c9633b51427fd080ab70fa62b65bc4","lessThan":"9c78f89cf2fbae18b14c78bf172ca15d832aff15","versionType":"git","status":"affected"},{"version":"4a96895f74c9633b51427fd080ab70fa62b65bc4","lessThan":"5cbab666721d974bfe033a12045d808936deaefd","versionType":"git","status":"affected"},{"version":"4a96895f74c9633b51427fd080ab70fa62b65bc4","lessThan":"941c9f84c9b6310f7aaa1c8c785dcc634ee33050","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/tty/serial/8250/8250_core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/5cbab666721d974bfe033a12045d808936deaefd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/68059b6e9f7292714286e2b0f5185ed2a43fccc5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/941c9f84c9b6310f7aaa1c8c785dcc634ee33050","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9c78f89cf2fbae18b14c78bf172ca15d832aff15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97481","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.583","lastModified":"2026-10-03T11:17:57.987","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nserial: 8250: fix possible ISR soft lockup\n\nThere are rare cases in which the host gets stuck in the ISR because it\nis flooded with messages during the startup phase.\n\nThe reason for the soft lockup in the ISR is the missing FIFO error IRQ\n(FIFOE) handling. Not handling it and reporting IRQ_HANDLED triggers\nthe IRQ immediately again.\n\nFix this by adding a check for the FIFOE status and clearing the FIFO\nif no data is ready (DR).\n\nThis behavior was observed on an AM62L device which uses the OMAP 8250\ndriver. Fix it for all 8250 drivers, since the OMAP driver's special\nIRQ setup handling may trigger this behavior more frequently, but it\nis not ensured that other 8250 drivers aren't affected."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/tty/serial/8250/8250_port.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4bce4a6f6318035d77d6b6199527b1950bb015f4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8b67af8cd90542b2607623e3282811849e191b79","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"95d0b40c0623fd2b58c753f8dd6adda7263e3cd1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"03ed804a0ddc3d069faf94c47f9e702afe5ca084","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2881b2e6da02daea1eb8254247ba8fd20c9d3348","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"4295c58990b7a84e8349a2226db692e252825b60","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0c6bf45e5a345cc3b9ffbeaf9083ecac3c2293eb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/tty/serial/8250/8250_port.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03ed804a0ddc3d069faf94c47f9e702afe5ca084","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0c6bf45e5a345cc3b9ffbeaf9083ecac3c2293eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2881b2e6da02daea1eb8254247ba8fd20c9d3348","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4295c58990b7a84e8349a2226db692e252825b60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4bce4a6f6318035d77d6b6199527b1950bb015f4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b67af8cd90542b2607623e3282811849e191b79","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/95d0b40c0623fd2b58c753f8dd6adda7263e3cd1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97482","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.707","lastModified":"2026-10-03T11:17:58.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log\n\ngoku_irq() handles a number of bus events under a single ep0 path.\nIt already guards the gadget driver suspend/resume callbacks against a\nNULL ->driver:\n\n\tif (dev->gadget.speed != USB_SPEED_UNKNOWN\n\t\t\t&& dev->driver\n\t\t\t&& dev->driver->resume) {\n\t\tspin_unlock(&dev->lock);\n\t\tdev->driver->resume(&dev->gadget);\n\t\t...\n\t}\n\nbut the very next branch unconditionally dereferences dev->driver\nwhen an INT_USBRESET arrives:\n\n\tif (stat & INT_USBRESET) {\n\t\tACK(INT_USBRESET);\n\t\tINFO(dev, \"USB reset done, gadget %s\\n\",\n\t\t\tdev->driver->driver.name);\n\t}\n\nIf the controller raises INT_USBRESET before any gadget driver has\nbeen bound (or after one has been unbound), dev->driver is NULL and\nthe printk dereferences NULL.\n\nsmatch flags the inconsistency:\n\n  drivers/usb/gadget/udc/goku_udc.c:1618 goku_irq() error:\n  we previously assumed 'dev->driver' could be null (see line 1607)\n\nFall back to a placeholder when the gadget driver is not bound.\n\nNo functional change while a gadget driver is bound."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/gadget/udc/goku_udc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d7b33afbf9b54b61cb423af9663df54eae11d3b1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ea2901a4a90afc662e4d023542d91f10ab10fd3c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"999ff3bf665f2abfb6af519ef3d6d42b061d3c15","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a018d4195114ca2cf79858cc45c98581dee4795b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"10d7fc3008d5b7ec03af8e08927f1d090014c2af","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"28d78783a871cdb7a637dcb72452ff7d303430ae","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/gadget/udc/goku_udc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/10d7fc3008d5b7ec03af8e08927f1d090014c2af","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/28d78783a871cdb7a637dcb72452ff7d303430ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5bf5e3fba9bc7dfd69701521dbe9809f8ccbdb02","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/999ff3bf665f2abfb6af519ef3d6d42b061d3c15","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a018d4195114ca2cf79858cc45c98581dee4795b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d7b33afbf9b54b61cb423af9663df54eae11d3b1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea2901a4a90afc662e4d023542d91f10ab10fd3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97483","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.820","lastModified":"2026-10-03T11:17:58.227","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusb: core: hcd: fix possible deadlock in rh control transfers\n\n>From within the SCSI error handler memory allocations must not\ntrigger IO. Handling errors in UAS and the storage driver may\ninvolve resetting a device. The thread doing the reset itself\nrelies on VM magic. However, that is insufficient, as resetting\na device involves resuming it. Resumption as well as resetting\ninvolves conrol transfers to the parent of the device to be reset.\nThat may be a root hub. Hence usbcore must heed the flags passed\nto usb_submit_urb() processing control transfers to root hubs.\n\nThe problem exist since the storage driver has been merged."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/core/hcd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"8461eda5af77c44d216cec66455bd5b01ee35c9a","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"8f82fc3d72e5feb7a1efae94b51b431c5bf41c86","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"936b08d87c667031725bcc753007e7c1182548c6","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"d0291fb4d91982d9f6a680bf759ff0555d351ecb","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"fff917c85d37a294397c5440a795591ca9d6b602","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"549672a3fb6b36ea408238f89ecf9f41d2da6225","versionType":"git","status":"affected"},{"version":"e57e780b346a7277fdd3bde765d9d8728b99bfa1","lessThan":"d5559f43d76b398392b26a15cbc16d731969cd1c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/core/hcd.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"3.12","status":"affected"},{"version":"0","lessThan":"3.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/549672a3fb6b36ea408238f89ecf9f41d2da6225","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8461eda5af77c44d216cec66455bd5b01ee35c9a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8f82fc3d72e5feb7a1efae94b51b431c5bf41c86","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/936b08d87c667031725bcc753007e7c1182548c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d0291fb4d91982d9f6a680bf759ff0555d351ecb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5559f43d76b398392b26a15cbc16d731969cd1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fff917c85d37a294397c5440a795591ca9d6b602","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97484","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:25.933","lastModified":"2026-10-03T11:17:58.343","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nusbip: vhci_hcd: fix NULL deref in status_show_vhci\n\nplatform_get_drvdata() can return NULL if a VHCI host controller's\nprobe failed (e.g. due to USB bus number exhaustion). status_show_vhci()\nchecked for a NULL pdev but not for a NULL hcd returned by\nplatform_get_drvdata(). Passing NULL to hcd_to_vhci_hcd() does not\nreturn NULL - it returns a pointer offset of 0x260, causing a NULL\npointer dereference when that value is subsequently dereferenced.\n\nAdd a NULL check on hcd before calling hcd_to_vhci_hcd(). Move\nstatus_show_not_ready() above status_show_vhci() to make it callable\nfrom the new error path without a forward declaration."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/usb/usbip/vhci_sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"2b477ee5cc9c2670185ffd82911a20e1760008c2","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"671d2687a790f63110c3c4213230209f5c3e0e8e","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"fd7d938ab4759a45eb107e658c199a2c47cc1ace","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"517c353e5358b2123cbf620a1798fe632fb7bdce","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"046a94fdb02eb1df86c8fa4614104ff801ba3ab7","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"dacd7c317ba12e035653c28a0eaaf23d91abc073","versionType":"git","status":"affected"},{"version":"0775a9cbc694e8c7276688be3bbd2f386167ab54","lessThan":"bc150783542ba2e7c1257d1299c6f3269bdba270","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/usb/usbip/vhci_sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/046a94fdb02eb1df86c8fa4614104ff801ba3ab7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2b477ee5cc9c2670185ffd82911a20e1760008c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/517c353e5358b2123cbf620a1798fe632fb7bdce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/671d2687a790f63110c3c4213230209f5c3e0e8e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bc150783542ba2e7c1257d1299c6f3269bdba270","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dacd7c317ba12e035653c28a0eaaf23d91abc073","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd7d938ab4759a45eb107e658c199a2c47cc1ace","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97485","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.050","lastModified":"2026-10-03T11:17:58.457","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nomfs: handle set_blocksize failures\n\nomfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting we will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/omfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"a2a3592ebf3920dd6f2b754d2bb7361f54764e84","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"d81e1e9bd1df5948c699cb5aec984acdef5b2681","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"120e0db84a69f18e51ba9ae2d036df3a052a33e1","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"29186cd17bb5f501a6ae831dac4fabf637879982","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"61ffc31cd8642d7a950b6831720629c8331365f6","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"fd4d6593c51253c79be422d6ae42e318250e20a7","versionType":"git","status":"affected"},{"version":"555e3775ced1d05203934fc6529bbf0560dd8733","lessThan":"18c3d6fcb557f920c9143711497625e70153874c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/omfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.27","status":"affected"},{"version":"0","lessThan":"2.6.27","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/120e0db84a69f18e51ba9ae2d036df3a052a33e1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/18c3d6fcb557f920c9143711497625e70153874c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/29186cd17bb5f501a6ae831dac4fabf637879982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/61ffc31cd8642d7a950b6831720629c8331365f6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2a3592ebf3920dd6f2b754d2bb7361f54764e84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d81e1e9bd1df5948c699cb5aec984acdef5b2681","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fd4d6593c51253c79be422d6ae42e318250e20a7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97486","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.160","lastModified":"2026-10-03T11:17:58.577","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nhpfs: handle set_blocksize failures\n\nhpfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/hpfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f7b0cde62edb8ceff8bcc17ba3f1b086646fff89","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b618f681acb6748faf95eee9af2aac5455a74e68","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"10f226687bcb07ed925a453b6f25e817165d113b","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0451927f42b0282d80d402e8e8c46ff34e9f606f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"fc79fcc78cb771f2a803e52149cac5ca9050fd05","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f27e21cf3c0446a3536ea9b588a78a46b0a2cb66","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a405996f23e04942aad064ab8d50c55827482872","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/hpfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0451927f42b0282d80d402e8e8c46ff34e9f606f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/10f226687bcb07ed925a453b6f25e817165d113b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a405996f23e04942aad064ab8d50c55827482872","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b618f681acb6748faf95eee9af2aac5455a74e68","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f27e21cf3c0446a3536ea9b588a78a46b0a2cb66","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f7b0cde62edb8ceff8bcc17ba3f1b086646fff89","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fc79fcc78cb771f2a803e52149cac5ca9050fd05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97487","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.263","lastModified":"2026-10-03T11:17:58.697","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\njfs: handle set_blocksize failures\n\njfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting we will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/jfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e2712fa5c02cd1b3e40d45bc8ce581f3c67bf4b4","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"deb9400a38849e03210c9169b777e89e74debe96","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a0eaa3f4b6dcc829228752f6255f0e45cc94b273","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"87d6852f06c5a29f757f7b7ad1423e4cbd0f2cad","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"a0ac22af8acca6ea6c57aff72662086cb3243b1c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"153374ee67a458c77b5755d3cc57fbdc639d327e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"05107f5602751fcfd3d108c1f579eb45aabead52","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/jfs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/05107f5602751fcfd3d108c1f579eb45aabead52","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/153374ee67a458c77b5755d3cc57fbdc639d327e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/87d6852f06c5a29f757f7b7ad1423e4cbd0f2cad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0ac22af8acca6ea6c57aff72662086cb3243b1c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0eaa3f4b6dcc829228752f6255f0e45cc94b273","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/deb9400a38849e03210c9169b777e89e74debe96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2712fa5c02cd1b3e40d45bc8ce581f3c67bf4b4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97488","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.370","lastModified":"2026-10-03T11:17:58.803","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nqnx4: handle set_blocksize failures\n\nqnx4 uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/qnx4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"de8bd760ca0c2a3f337bbafbeb1dcad0853787cc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"3f2088a3973faf3ed9b56ea3d3f0240b9a797016","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c9f03e750d9ddf0f42c24e3ba683f26e377ffd72","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f83e416c2242fb298ad33b756c83aae75d9e359c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"aac97a4b3f47c36a47f934aa679407b718b67537","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"60f7ccf669882262330171eda51a4f52fa2e69c9","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c7d911ea1cc9a63b07e52f5e75b263be0615b289","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/qnx4/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3f2088a3973faf3ed9b56ea3d3f0240b9a797016","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60f7ccf669882262330171eda51a4f52fa2e69c9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aac97a4b3f47c36a47f934aa679407b718b67537","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7d911ea1cc9a63b07e52f5e75b263be0615b289","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9f03e750d9ddf0f42c24e3ba683f26e377ffd72","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/de8bd760ca0c2a3f337bbafbeb1dcad0853787cc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f83e416c2242fb298ad33b756c83aae75d9e359c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97489","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.490","lastModified":"2026-10-03T11:17:58.920","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbfs: handle set_blocksize failures\n\nbfs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting will hit the\n\n\tBUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/bfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"965b53ee91cfda3faf8bd0d0ffff5f70c7d1c479","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0fe260d82555ffebfb627cd23cbb6e880399804c","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c6d069c34d57414c039167967ef826a8516c98f3","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"8a96010d230a8c83181137d88bad4bf71d862628","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"7cc713b29eecc0189a184e82f42d174fddaa9e1e","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ab1d6160d26e6ee8939e994999be9b45e90a42ef","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2430e3380936df0b648af720cae624eef035a2d1","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/bfs/inode.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0fe260d82555ffebfb627cd23cbb6e880399804c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2430e3380936df0b648af720cae624eef035a2d1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cc713b29eecc0189a184e82f42d174fddaa9e1e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8a96010d230a8c83181137d88bad4bf71d862628","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/965b53ee91cfda3faf8bd0d0ffff5f70c7d1c479","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ab1d6160d26e6ee8939e994999be9b45e90a42ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6d069c34d57414c039167967ef826a8516c98f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97490","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.603","lastModified":"2026-10-03T11:17:59.030","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naffs: handle set_blocksize failures\n\naffs uses buffer_heads, which don't handle block size > PAGE_SIZE well.\nWithout this, mounting we will hit the\n\n        BUG_ON(offset >= folio_size(folio));\n\nin folio_set_bh on the first __bread_gfp call."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/affs/affs.h","fs/affs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"f5d65b2811872e8f8b424860fa7c2500afbbc5a6","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"c7f29c5d999093629712c63792abda89a36b428d","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d05b0ee9b42cb3cc499272d1bc91609f7492a1a8","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"ea8a4a9f3cc101207611be724a8b83838de9a93f","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"bb45146a661934ef801f8fc62f88cdbcf6584ed1","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"e01af5aa641039e000af855f448475316f0550fc","versionType":"git","status":"affected"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"0861182af5983a39bd2a891966436c5679b74a45","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/affs/affs.h","fs/affs/super.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0861182af5983a39bd2a891966436c5679b74a45","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb45146a661934ef801f8fc62f88cdbcf6584ed1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c7f29c5d999093629712c63792abda89a36b428d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d05b0ee9b42cb3cc499272d1bc91609f7492a1a8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e01af5aa641039e000af855f448475316f0550fc","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea8a4a9f3cc101207611be724a8b83838de9a93f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5d65b2811872e8f8b424860fa7c2500afbbc5a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97491","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.720","lastModified":"2026-10-03T11:17:59.147","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Don't sleep inside rds_ib_conn_path_shutdown\n\nNew rds rdma self tests exposed a hang when tearing down\nthe ib network configs.  This is caused by the shutdown worker\nthread sleeping on the wait_event call, which blocks other work\nitems in the queue. Fix this by changing wait_event to\nwait_event timeout, and looping until the wait check succeeds."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/ib_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"b3621acf640e32dcb986d9b3767f2387f29dad05","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"ac0bc28da5150c4fa81a76172fff5ec70f2063eb","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"934a6381c79d815680c955d676791322e020bfda","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"07a348d48e589b91a0d5a5cfa0de137cc703fabf","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"db22e77df66353f1299153f6fa9620a2825bc63f","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"caa51e6da596ed6008cd06605a725568b8e7be4e","versionType":"git","status":"affected"},{"version":"ec16227e14141e4fd7ae76354c09dadfe2449d9e","lessThan":"16f48efaeb6991193fb7775c577f06f5b20b0c90","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/ib_cm.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/07a348d48e589b91a0d5a5cfa0de137cc703fabf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/16f48efaeb6991193fb7775c577f06f5b20b0c90","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/934a6381c79d815680c955d676791322e020bfda","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac0bc28da5150c4fa81a76172fff5ec70f2063eb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b3621acf640e32dcb986d9b3767f2387f29dad05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/caa51e6da596ed6008cd06605a725568b8e7be4e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db22e77df66353f1299153f6fa9620a2825bc63f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97492","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.833","lastModified":"2026-10-21T13:21:10.713","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed\n\nIn case reconfiguration of NAN fails, we call\nieee80211_handle_reconfig_failure, that marks all interfaces as not in\nthe driver.\nThen, at the error path of the reconfig, cfg80211_shutdown_all_interfaces\nis called to destroy all the interfaces.\n\nIf we have any other interface but the NAN one, for example a BSS\nstation, then when its state (links, stations) will be removed, we\nwon't tell the driver about this, because we will think that the\ninterfaces are not in the driver, and then drivers might remain with\ndangling pointers to objects like stations and links (at least for\niwlwifi this is the case).\n\nieee80211_handle_reconfig_failure is meant to be called after we cleaned\nup the state in the driver, there is no reason to call it for NAN\nreconfiguration failure.\n\nFix the code to just warn in such a case, as we do in other error paths\nin reconfig where it is too complicated to rewind."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"026637b864b16dfae238e7e1accded820a3d7ae8","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"6ef85dd9f8c62c9a465a32901d09475a114e67bd","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"f27a5bda84ff3b0fea3de7572ff48e518e66cf5d","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"d2ea99884793c0a8d940073c3dddbb887590718f","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"60b96e44489d6775fe9cd8df619c29e0dc285c49","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"6fb64029457cdcd77be546daf4c7c7cf04891857","versionType":"git","status":"affected"},{"version":"167e33f4f68cc8e4e3bdaf6d43641176c51f2d79","lessThan":"7a8a3ff2815501f78f494808355ddf37e08647d0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/util.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.9","status":"affected"},{"version":"0","lessThan":"4.9","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/026637b864b16dfae238e7e1accded820a3d7ae8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/60b96e44489d6775fe9cd8df619c29e0dc285c49","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6ef85dd9f8c62c9a465a32901d09475a114e67bd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fb64029457cdcd77be546daf4c7c7cf04891857","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7a8a3ff2815501f78f494808355ddf37e08647d0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d2ea99884793c0a8d940073c3dddbb887590718f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f27a5bda84ff3b0fea3de7572ff48e518e66cf5d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97493","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:26.947","lastModified":"2026-10-21T13:21:10.883","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Bound GPIO I2C table entry count from VBIOS\n\nReject undersized tables and cap the derived entry count\nto AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[]\nor walk an absurd number of entries on corrupt size fields."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"0786b38af822fcd153d565cc85be7dbd9fed4d25","versionType":"git","status":"affected"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"6db45123306c7167c6867ca3d24924bd7960d947","versionType":"git","status":"affected"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"f8f0985375c3b977757fd73e2b691ff1bf1ea7b9","versionType":"git","status":"affected"},{"version":"d38ceaf99ed015f2a0b9af3499791bd3a3daae21","lessThan":"a99cd231cd924b7160fecb9fb3a94b801522323b","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.2","status":"affected"},{"version":"0","lessThan":"4.2","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0786b38af822fcd153d565cc85be7dbd9fed4d25","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6db45123306c7167c6867ca3d24924bd7960d947","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a99cd231cd924b7160fecb9fb3a94b801522323b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f8f0985375c3b977757fd73e2b691ff1bf1ea7b9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97494","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.060","lastModified":"2026-10-21T13:21:10.997","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw\n\nChange psp_copy_fw from void to int: return -ENODEV when drm_dev_enter\nfails, and -EINVAL when the image size is zero or larger than the\n1 MiB PSP private buffer.\n\nReplace open-coded memset/memcpy into fw_pri_buf with psp_copy_fw."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c","drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h","drivers/gpu/drm/amd/amdgpu/psp_v11_0.c","drivers/gpu/drm/amd/amdgpu/psp_v12_0.c","drivers/gpu/drm/amd/amdgpu/psp_v13_0.c","drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c","drivers/gpu/drm/amd/amdgpu/psp_v14_0.c","drivers/gpu/drm/amd/amdgpu/psp_v3_1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2b0c3aee2172451e9f982b25f3fdf59a1b687dc3","lessThan":"8ddda06ae356fda0418b7017e658d976dad6214e","versionType":"git","status":"affected"},{"version":"2b0c3aee2172451e9f982b25f3fdf59a1b687dc3","lessThan":"25bec2425c3d50ba9a92ad87bbf8628be29e5c32","versionType":"git","status":"affected"},{"version":"2b0c3aee2172451e9f982b25f3fdf59a1b687dc3","lessThan":"1aa55af304a2decaacca1d1fabe4257c277ca54a","versionType":"git","status":"affected"},{"version":"2b0c3aee2172451e9f982b25f3fdf59a1b687dc3","lessThan":"d1f9f5839bd785a3a06335a01d53282e80f8e5fa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c","drivers/gpu/drm/amd/amdgpu/amdgpu_psp.h","drivers/gpu/drm/amd/amdgpu/psp_v11_0.c","drivers/gpu/drm/amd/amdgpu/psp_v12_0.c","drivers/gpu/drm/amd/amdgpu/psp_v13_0.c","drivers/gpu/drm/amd/amdgpu/psp_v13_0_4.c","drivers/gpu/drm/amd/amdgpu/psp_v14_0.c","drivers/gpu/drm/amd/amdgpu/psp_v3_1.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1aa55af304a2decaacca1d1fabe4257c277ca54a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25bec2425c3d50ba9a92ad87bbf8628be29e5c32","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ddda06ae356fda0418b7017e658d976dad6214e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d1f9f5839bd785a3a06335a01d53282e80f8e5fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97495","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.173","lastModified":"2026-10-03T11:17:59.373","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check bounds on allocate_doorbell\n\nallocated_doorbell has an option to set the doorbell id\nto a specific value (used by CRIU). This value was not\nbounds checked.\n\nCheck to confirm it's less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"7e06636260a2d95e3fa181bc337d0eeb812b7a41","versionType":"git","status":"affected"},{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"3d2ddfc9b361b0d38c3ff4804ce42503e4bc97de","versionType":"git","status":"affected"},{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"e0cecd04a4fc4c75e375b91cf53eab5ba2e4ab7f","versionType":"git","status":"affected"},{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"c2c89118c27cbd3adace62c5df19d15b0e96ade1","versionType":"git","status":"affected"},{"version":"5bb6a8fa75fcfda93592bee0a4910420ceab15f3","lessThan":"1f087bb8cf9e8797633da35c85435e557ef74d06","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1f087bb8cf9e8797633da35c85435e557ef74d06","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3d2ddfc9b361b0d38c3ff4804ce42503e4bc97de","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7e06636260a2d95e3fa181bc337d0eeb812b7a41","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2c89118c27cbd3adace62c5df19d15b0e96ade1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e0cecd04a4fc4c75e375b91cf53eab5ba2e4ab7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97496","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.290","lastModified":"2026-10-03T11:17:59.480","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Fix OOB memory exposure in get_wave_state()\n\nThe get_wave_state() function for v9 trusts cp_hqd_cntl_stack_size and\ncp_hqd_cntl_stack_offset values read directly from the MQD, which are\nwritten by GPU microcode and fully attacker-controlled on the\nCRIU-restore path (via AMDKFD_IOC_RESTORE_PROCESS with H3).\n\nthis leads to an unbounded copy_to_user() that can leak adjacent\nGTT/kernel memory. If offset > size, integer underflow produces a ~4 GiB\nread length, if size is set to 1 MiB against a 4 KiB allocation, we leak\n1 MiB of adjacent kernel memory (other queues' MQDs, ring buffers, KASLR\npointers).\n\nFix by clamping both cp_hqd_cntl_stack_size to the actual allocated\nbuffer size (q->ctl_stack_size) and cp_hqd_cntl_stack_offset to the\nclamped size before performing arithmetic and copy_to_user().\n\nThis ensures we never read beyond the allocated kernel BO regardless of\nattacker-supplied MQD field values."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"42c6c48214b726c30918e8dc80e2168607d13ae4","lessThan":"e2bef0f168be46692a6b900916ff5da3771480ed","versionType":"git","status":"affected"},{"version":"42c6c48214b726c30918e8dc80e2168607d13ae4","lessThan":"d9183d974ddd5f09d029beaf359275ac20d4d5fe","versionType":"git","status":"affected"},{"version":"42c6c48214b726c30918e8dc80e2168607d13ae4","lessThan":"ec646686613d8ab05b282d1463a7baa49fd6b83b","versionType":"git","status":"affected"},{"version":"42c6c48214b726c30918e8dc80e2168607d13ae4","lessThan":"7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v9.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/7ef144458f48d5589e36f1b3d83e83db2e5c5ba5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9183d974ddd5f09d029beaf359275ac20d4d5fe","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e2bef0f168be46692a6b900916ff5da3771480ed","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ec646686613d8ab05b282d1463a7baa49fd6b83b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97497","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.410","lastModified":"2026-10-03T11:17:59.613","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id\n\nallocate_sdma_queue has an option where the sdma queue id can be\nspecified (used by CRIU). We weren't bounds-checking that\nvalue.\n\nConfirm it's less than the maximum number of queues."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"41460d2dd0246f0ab7e80b103d34c8649e022999","versionType":"git","status":"affected"},{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3","versionType":"git","status":"affected"},{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"42f2bd50236b61ad0aeb2c233c990ee0d615fdad","versionType":"git","status":"affected"},{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"dd2870ca036e1d51baa59f942007b36a595b5890","versionType":"git","status":"affected"},{"version":"2485c12c980a36bb9e23ababb07d73c4ac6a45af","lessThan":"bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/25e1b29ecc8da3609ba0072ca54a3b1fdd1578f3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/41460d2dd0246f0ab7e80b103d34c8649e022999","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42f2bd50236b61ad0aeb2c233c990ee0d615fdad","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bfe9a7545b2a7be1c543f1741e16f2d5ec4116ae","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dd2870ca036e1d51baa59f942007b36a595b5890","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97498","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.527","lastModified":"2026-09-28T06:16:35.800","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu/userq: pin mqd and fw object bo to avoid eviction\n\nmqd and fw objects are queue core objects which should remain\nvalid and never be unmapped and evicted for user queues to work\nproperly.\n\nDuring eviction if these buffers are evicted the hw continue to\nuse the invalid addresses and caused page faults and system hung."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0385800c2ff7bddf16a9caad5840f4e4823253f2","lessThan":"a16d9986b7b27b08a696524a4dbf03dbf5433a16","versionType":"git","status":"affected"},{"version":"0385800c2ff7bddf16a9caad5840f4e4823253f2","lessThan":"a3bbf32a336939a1d21b9561f8e53333b684b7ef","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/a16d9986b7b27b08a696524a4dbf03dbf5433a16","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a3bbf32a336939a1d21b9561f8e53333b684b7ef","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97499","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.630","lastModified":"2026-09-28T06:16:35.893","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: perf: Retrieve path and source from event data\n\nETM perf callbacks currently use the per-CPU csdev_src pointer, which\ncan race with updates during device registration and unregistration.\n\nThe AUX setup already builds and stores the path in the event data.\nUse this path to retrieve the source instead of csdev_src to avoid\nthe race.\n\nExport coresight_get_source() and add etm_event_get_ctxt_path() to\nretrieve the context's path and its source with READ_ONCE() /\nWRITE_ONCE() accessors. Give the comments to explain why this\napproach is safe when pause or resume callbacks preempt the disable\ncallback (e.g. via NMI)."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/hwtracing/coresight/coresight-core.c","drivers/hwtracing/coresight/coresight-etm-perf.c","drivers/hwtracing/coresight/coresight-priv.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0bcbf2e30ff2271b54f54c8697a185f7d86ec6e4","lessThan":"0f4cb08f30011b7625a4fba668fa5c36da5e6637","versionType":"git","status":"affected"},{"version":"0bcbf2e30ff2271b54f54c8697a185f7d86ec6e4","lessThan":"f37bc31447c0ddafedb25e3c4a4f4e2284034247","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/hwtracing/coresight/coresight-core.c","drivers/hwtracing/coresight/coresight-etm-perf.c","drivers/hwtracing/coresight/coresight-priv.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.6","status":"affected"},{"version":"0","lessThan":"4.6","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0f4cb08f30011b7625a4fba668fa5c36da5e6637","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f37bc31447c0ddafedb25e3c4a4f4e2284034247","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97500","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.740","lastModified":"2026-10-03T11:17:59.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw89: phy: check length before parsing PHY status IE\n\nHardware might report PHY status IE with unexpected length, and parser\nmight access out of range. Check the length ahead."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/realtek/rtw89/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd","lessThan":"72bf6944e336d6f046f5c886ebededdd6560a693","versionType":"git","status":"affected"},{"version":"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd","lessThan":"213f9e0ab2b4f35fe8d342333238c6cc91513fbf","versionType":"git","status":"affected"},{"version":"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd","lessThan":"98e5720afd7495eece580238f232e3b3b4c022da","versionType":"git","status":"affected"},{"version":"e3ec7017f6a20d12ddd9fe23d345ebb7b8c104dd","lessThan":"884495c39de1a02f42bd40051b921e2311d6ac91","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/realtek/rtw89/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/213f9e0ab2b4f35fe8d342333238c6cc91513fbf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/72bf6944e336d6f046f5c886ebededdd6560a693","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/884495c39de1a02f42bd40051b921e2311d6ac91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/98e5720afd7495eece580238f232e3b3b4c022da","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97501","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.850","lastModified":"2026-10-21T13:21:11.113","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction\n\npinctrl_gpio_direction_input() / pinctrl_gpio_direction_output() take\nthe pinctrl mutex. This causes a gpiochip operations to need to sleep.\nWorse yet, the .can_sleep field in the gpiochip is not set. This causes\nthe shared GPIO proxy to trip over, as it uses gpiod_cansleep() to check\nwhether it can use a spinlock or needs a mutex. In this case, it ends\nup taking a spinlock, then calls pinctrl_gpio_direction_output(), which\ntakes a mutex. This causes a huge warning.\n\nWhile this class of Mediatek hardware does not have separate clear/set\nregisters, the pinctrl context has a spinlock that is taken whenever\na register read-modify-write is done. Also, once the GPIO function is\nselected / muxed in, further GPIO operations do not involve pinctrl\noperations or state. The GPIO direction and level values do not require\ntoggling the pinmux or any other pin config options.\n\nSwitch to directly calling mtk_pinmux_gpio_set_direction() in the GPIO\nset direction callbacks to avoid taking the pinctrl mutex. Drop the\n.gpio_set_direction field in mtk_pmxops to signal we are no longer using\nthe pinctrl GPIO layer for setting the direction."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pinctrl/mediatek/pinctrl-paris.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"805250982bb5c5ce4a6e52e1d87204c5feea0dd1","lessThan":"482ba972f9638f467df2d498b46384a1d1f80529","versionType":"git","status":"affected"},{"version":"805250982bb5c5ce4a6e52e1d87204c5feea0dd1","lessThan":"3c4897861759fd8bd81dc2ada92121ac76332592","versionType":"git","status":"affected"},{"version":"805250982bb5c5ce4a6e52e1d87204c5feea0dd1","lessThan":"428b031dad390edd5da729b9afd474a95dc4f76b","versionType":"git","status":"affected"},{"version":"805250982bb5c5ce4a6e52e1d87204c5feea0dd1","lessThan":"c87c9046c4e00d599454e033a477176c4d73ac2a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pinctrl/mediatek/pinctrl-paris.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.20","status":"affected"},{"version":"0","lessThan":"4.20","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3c4897861759fd8bd81dc2ada92121ac76332592","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/428b031dad390edd5da729b9afd474a95dc4f76b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/482ba972f9638f467df2d498b46384a1d1f80529","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c87c9046c4e00d599454e033a477176c4d73ac2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97502","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:27.963","lastModified":"2026-10-03T11:17:59.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmmc: davinci: avoid NULL deref of host->data in IRQ handler\n\nmmc_davinci_irq() returns early only when both host->cmd and\nhost->data are NULL:\n\n  if (host->cmd == NULL && host->data == NULL) {\n          ...\n          return IRQ_NONE;\n  }\n\nSo we may legitimately reach the rest of the handler with\nhost->data == NULL (and therefore data == NULL). The DATDNE branch\nalready guards against this with an explicit \"if (data != NULL)\"\ncheck, but the subsequent TOUTRD (\"read data timeout\") and\nCRCWR/CRCRD (\"data CRC error\") branches dereference data\nunconditionally:\n\n  if (qstatus & MMCST0_TOUTRD) {\n          data->error = -ETIMEDOUT;        <-- NULL deref\n          ...\n          davinci_abort_data(host, data);\n  }\n\n  if (qstatus & (MMCST0_CRCWR | MMCST0_CRCRD)) {\n          data->error = -EILSEQ;           <-- NULL deref\n          ...\n  }\n\nIf either bit is set in qstatus while host->data is NULL, the kernel\nwill crash inside the IRQ handler. smatch flags this:\n\n  drivers/mmc/host/davinci_mmc.c:933 mmc_davinci_irq() error: we\n    previously assumed 'data' could be null (see line 914)\n\nGate both branches on a non-NULL data, matching the existing pattern\nused by the DATDNE branch.\n\nNo functional change for callers where data is non-NULL, which is\nthe only case in which these branches did meaningful work before\nthis change."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/mmc/host/davinci_mmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"f216cf00e829895ff49bdf695c944915e59bd698","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"3c5e3e5badbf0592332887d12db02458323682c3","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"a01cedf230dc0fcd55b994f5e548d3982ba4c732","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"5b7e151fe9ea9311ba601849aaecdc4fc97fd577","versionType":"git","status":"affected"},{"version":"b4cff4549b7a8c5fc8b88e3493b6287555f0512c","lessThan":"4f28846aaf8db9668e338b8987973f8935edff34","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/mmc/host/davinci_mmc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.33","status":"affected"},{"version":"0","lessThan":"2.6.33","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3c5e3e5badbf0592332887d12db02458323682c3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4f28846aaf8db9668e338b8987973f8935edff34","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/51738de7dd5f8e8b33dfc07ef85bc06d3bf41e96","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5b7e151fe9ea9311ba601849aaecdc4fc97fd577","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a01cedf230dc0fcd55b994f5e548d3982ba4c732","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a0cde8d70d64c1a75fbd57f01d9f2d7cccac8319","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f216cf00e829895ff49bdf695c944915e59bd698","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97503","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.080","lastModified":"2026-10-21T13:21:11.260","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngenirq/proc: Size interrupt directory names for 10-digit interrupt numbers\n\n/proc/irq/<n>/ directory names are built in `char name[10]` buffers\nwith `sprintf(name, \"%u\", irq)`.\n\nTen-digit IRQ numbers already need 11 bytes including the trailing NUL, and\ncurrent sparse-IRQ configurations allow interrupt numbers in that range.\n\nSize the temporary name buffer for the current decimal form and switch\nto bounded formatting when creating or removing the proc entry."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/irq/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"721255b9826bd11c7a38b585905fc2dd0fb94e52","lessThan":"a8adf64fe7fd5d7c476769a043ee56eda7b775ce","versionType":"git","status":"affected"},{"version":"721255b9826bd11c7a38b585905fc2dd0fb94e52","lessThan":"488bcd7fd3e9a2ad647b71b505a269fdb28753c4","versionType":"git","status":"affected"},{"version":"721255b9826bd11c7a38b585905fc2dd0fb94e52","lessThan":"d4b22fbae70037299e96539c330e4a1054b28a91","versionType":"git","status":"affected"},{"version":"721255b9826bd11c7a38b585905fc2dd0fb94e52","lessThan":"c2c7983c93f5d86962318be7e7298f1bc3feb1a6","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/irq/proc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.5","status":"affected"},{"version":"0","lessThan":"6.5","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/488bcd7fd3e9a2ad647b71b505a269fdb28753c4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8adf64fe7fd5d7c476769a043ee56eda7b775ce","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c2c7983c93f5d86962318be7e7298f1bc3feb1a6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4b22fbae70037299e96539c330e4a1054b28a91","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97504","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.200","lastModified":"2026-09-28T06:16:36.373","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwatchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk\n\nReview by sashiko.dev highlighted potential use after free and resource\nleak instances.\n\nSet se10_pdev to null to prevent use after free\n\nRemove DMI call back and instead directly call\nse10_create_platform_device. Handle error cases appropriately"}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/watchdog/lenovo_se10_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1f6602c8ed1eccac4fa83e338d02aafe3a0e2c0a","lessThan":"e9adbc3a116dfa8c7b643180dabf6166c99bcec7","versionType":"git","status":"affected"},{"version":"1f6602c8ed1eccac4fa83e338d02aafe3a0e2c0a","lessThan":"c9f1fb55646534370b00824a1fdb47718c72f115","versionType":"git","status":"affected"},{"version":"1f6602c8ed1eccac4fa83e338d02aafe3a0e2c0a","lessThan":"3394e894880a60338a2981dd688fd25e88d79667","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/watchdog/lenovo_se10_wdt.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/3394e894880a60338a2981dd688fd25e88d79667","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c9f1fb55646534370b00824a1fdb47718c72f115","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9adbc3a116dfa8c7b643180dabf6166c99bcec7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97505","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.310","lastModified":"2026-10-21T13:21:11.390","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nPCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()\n\nCurrently, the __resource_resize_store() allows writing to the\nresourceN_resize sysfs attribute to change a BAR's size without checking\nfor capabilities, currently relying only on the file access check.\n\nResizing a BAR modifies PCI device configuration and can disrupt active\ndrivers.  After the upcoming conversion to static attributes, it will also\ntrigger resource file updates via sysfs_update_groups().\n\nAdd a CAP_SYS_ADMIN check to prevent unprivileged users from performing BAR\nresize operations."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/pci/pci-sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"91fa127794ac1c48069479b9d45eb4c7378c0e30","lessThan":"d02dd7ce8e52b66b7d3b6eca2a7d81e7f5b10a62","versionType":"git","status":"affected"},{"version":"91fa127794ac1c48069479b9d45eb4c7378c0e30","lessThan":"b722a607f858b9cd036075ea0efad553fb98e982","versionType":"git","status":"affected"},{"version":"91fa127794ac1c48069479b9d45eb4c7378c0e30","lessThan":"cbf0628c0b7db86c5ce36451f088101546acbf1d","versionType":"git","status":"affected"},{"version":"91fa127794ac1c48069479b9d45eb4c7378c0e30","lessThan":"25ec7f57deceec633f27bc93b615f951e2ade814","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/pci/pci-sysfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.1","status":"affected"},{"version":"0","lessThan":"6.1","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/25ec7f57deceec633f27bc93b615f951e2ade814","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b722a607f858b9cd036075ea0efad553fb98e982","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cbf0628c0b7db86c5ce36451f088101546acbf1d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d02dd7ce8e52b66b7d3b6eca2a7d81e7f5b10a62","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97506","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.423","lastModified":"2026-10-03T11:17:59.963","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ixp4xx - fix buffer chain unwind on allocation failure\n\nchainup_buffers() builds a linked list of buffer descriptors for a\nscatterlist. If dma_pool_alloc() fails while constructing the list, the\ncurrent code sets buf to NULL and later dereferences it unconditionally\nat the end of the function:\n\n  buf->next = NULL;\n  buf->phys_next = 0;\n\nThis can lead to a null-pointer dereference on allocation failure.\n\nIf the failure happens after part of the descriptor chain has already\nbeen allocated and DMA-mapped, the partially constructed chain also\nneeds to be released.\n\nFix this by terminating the partially constructed chain on allocation\nfailure and letting the callers unwind it via their existing cleanup\npaths. Also fix ablk_perform() to preserve the hook pointers before\nchecking for failure, so partially built chains can be freed correctly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"d4007867be42d71795b78fa7f8ce7514dda9ca83","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"4918b0bd7d2baafb45d87dca9e322137c96005c2","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"8c37bc8d6a6f77bf9593fb1bcab6c14c7cf02991","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"04cb00106ca4d0fa9eca24cadc4eda6036e855c8","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"028a7f4f3d69e551f6bf9f728d547bbf4cfc707d","versionType":"git","status":"affected"},{"version":"0d44dc59b2b434b29aafeae581d06f81efac7c83","lessThan":"25056329384010a8672552b134f609601dc4f80e","versionType":"git","status":"affected"},{"version":"5a80273150a8a1725fa70418d106eb1f2ee8fd2f","versionType":"git","status":"affected"},{"version":"82a8becb9c2c52fc5e67057a43aeded1f0731e7b","versionType":"git","status":"affected"},{"version":"68845515c8b11791b547a2838e22c27dfa3115ee","versionType":"git","status":"affected"},{"version":"2.6.27.22","lessThan":"2.6.28","versionType":"semver","status":"affected"},{"version":"2.6.28.10","lessThan":"2.6.29","versionType":"semver","status":"affected"},{"version":"2.6.29.3","lessThan":"2.6.30","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/crypto/intel/ixp4xx/ixp4xx_crypto.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.30","status":"affected"},{"version":"0","lessThan":"2.6.30","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/028a7f4f3d69e551f6bf9f728d547bbf4cfc707d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/04cb00106ca4d0fa9eca24cadc4eda6036e855c8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/25056329384010a8672552b134f609601dc4f80e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4918b0bd7d2baafb45d87dca9e322137c96005c2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8c37bc8d6a6f77bf9593fb1bcab6c14c7cf02991","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d4007867be42d71795b78fa7f8ce7514dda9ca83","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97507","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.540","lastModified":"2026-10-03T11:18:00.093","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dm1105: fix missing error check for dma_alloc_coherent\n\nThe return value of dm1105_dma_map(), which handles DMA memory allocation,\nis ignored in dm1105_hw_init(). If dma_alloc_coherent() fails, the driver\nwill proceed using a NULL pointer for DMA transfers, leading to a kernel\noops or invalid hardware access.\n\nFix this by checking the return value and propagating -ENOMEM on failure."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/pci/dm1105/dm1105.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"a2017c80dd7f3c409778ca0898d6e75ccab6d2f2","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"e96f91da5c83e4c1f1bebe1c58856d02cea4afd9","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"3ff12d5ea9cb0d0fd89c24b69940f0b989bf6d2a","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"b6327023dcc7482156fc13cda6361ee573721b05","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"07d6a76a17b550e94ca5cc0060ad6e77952390f2","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"f3f135c4fac6194933b952e98a15dc05aa420956","versionType":"git","status":"affected"},{"version":"a611d0ca006fe76d88b8dd5ac44f4468293b6760","lessThan":"3eaac9e02d8591d3c790db572ef1c8fa5a841fdb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/pci/dm1105/dm1105.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.28","status":"affected"},{"version":"0","lessThan":"2.6.28","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/07d6a76a17b550e94ca5cc0060ad6e77952390f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3eaac9e02d8591d3c790db572ef1c8fa5a841fdb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3ff12d5ea9cb0d0fd89c24b69940f0b989bf6d2a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a2017c80dd7f3c409778ca0898d6e75ccab6d2f2","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b6327023dcc7482156fc13cda6361ee573721b05","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e96f91da5c83e4c1f1bebe1c58856d02cea4afd9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f3f135c4fac6194933b952e98a15dc05aa420956","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97508","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.650","lastModified":"2026-10-03T11:18:00.283","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Set tb->root_switch to NULL when domain is stopped\n\nSimilarly what we do with the firmware connection manager. This makes\ntb_xdp_handle_request() return error to the remote host. However, we\nneed to make sure we keep the uuid alive so that we can reply until the\nwhole domain is released."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thunderbolt/tb.c","drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"d9a638e7bc87e0e6fe3a75517ac481e72fc0058c","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"66b0fe27e277713c2b9f3c452c76330ed0bd7eaf","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"54ad3415cc211ca0d64ae1bf3234d6eb5c6aedd0","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"83d1af5b1b6e6c96ffa633ca2c9a77f6f4c93efa","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"f06e9fbae78a51832211b4495a19412c7d49ecb4","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"99f019d2e9eb79adc485fef8aa8ada2cd0c843e9","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"e56249d8a68e712f3b60e1f3fdbb5b4fea146468","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thunderbolt/tb.c","drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/54ad3415cc211ca0d64ae1bf3234d6eb5c6aedd0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/66b0fe27e277713c2b9f3c452c76330ed0bd7eaf","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/83d1af5b1b6e6c96ffa633ca2c9a77f6f4c93efa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/99f019d2e9eb79adc485fef8aa8ada2cd0c843e9","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9a638e7bc87e0e6fe3a75517ac481e72fc0058c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e56249d8a68e712f3b60e1f3fdbb5b4fea146468","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f06e9fbae78a51832211b4495a19412c7d49ecb4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97509","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.767","lastModified":"2026-10-03T11:18:00.487","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Keep XDomain reference during the lifetime of a service\n\nThis is needed because we release the service ID in tb_service_release()\nand the ID array is owned by the parent XDomain."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"a4567e5380e4e46d0ea9a28d2d675e5c6f013d54","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"daeaa6c7211d03ed061b0dd22a875fad9372b090","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"cca72fe513f3d6b1279fe83483f8a8990adbe0c6","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"8ab12d015884b8aa85ea7ed58c5a0bae4264fe60","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"8b4060998637f06975fceee9b73845d8672d411e","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"5.10.266","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.217","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/57359bb31526c2f1bb0a7b9b69d8b8a6bd3f0e9f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8ab12d015884b8aa85ea7ed58c5a0bae4264fe60","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b4060998637f06975fceee9b73845d8672d411e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a4567e5380e4e46d0ea9a28d2d675e5c6f013d54","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cca72fe513f3d6b1279fe83483f8a8990adbe0c6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/daeaa6c7211d03ed061b0dd22a875fad9372b090","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ea60ae6233ca0fc0d414e9c11f0d86c63b303fc7","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97510","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.887","lastModified":"2026-10-03T11:18:00.627","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nthunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()\n\nIf tb_cfg_request() fails setting up the request (for example the\ncontrol channel is shut down already) it returns an error without\ncalling the callback. To avoid leaking that memory, call\ntb_cfg_request_put() if tb_cfg_request() fails."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"dbc8a8dd7c1930043c473818fcadcf88cb5e1c4d","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"487ee7dbad21d1e757f5dd490ac182aebfa5f689","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"000189b249e45e63ee873d0c59c3be1805349681","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"9d6657674919bef57c8a7195170263f3456e9876","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"42dddadf6b6131af4d12bfa8bdc84ef954e8cef8","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"0325d017bf4354a015a02413ee1c7e51266cecf4","versionType":"git","status":"affected"},{"version":"d1ff70241a275133e1a0258b7c23588b122276c8","lessThan":"4c63f29872cb444b33665348bbd2f45cab06afcd","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/thunderbolt/xdomain.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","versionType":"semver","status":"unaffected"},{"version":"5.10.271","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.222","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/000189b249e45e63ee873d0c59c3be1805349681","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0325d017bf4354a015a02413ee1c7e51266cecf4","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42dddadf6b6131af4d12bfa8bdc84ef954e8cef8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/487ee7dbad21d1e757f5dd490ac182aebfa5f689","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4c63f29872cb444b33665348bbd2f45cab06afcd","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9d6657674919bef57c8a7195170263f3456e9876","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dbc8a8dd7c1930043c473818fcadcf88cb5e1c4d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97511","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:28.993","lastModified":"2026-09-28T06:16:37.117","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: avoid out-of-bounds access in monitor\n\nIn NAN, we don't know on what band the frame will be sent. Therefore we\nset info->band to NUM_NL80211_BANDS. However, this leads to out-of-bound\naccess in ieee80211_add_tx_radiotap_header when we try to access the\nsbands array.\n\nFix it by not accessing the array if the band is NUM_NL80211_BANDS.\nThis means that we will not report rate info for legacy rate in NAN.\nBut nobody really cares about it."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/mac80211/status.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fc41f4a28ac4d462487903229494eeb266f68a40","lessThan":"7f087f70e020b16a5b967332ee6e937817eaa173","versionType":"git","status":"affected"},{"version":"fc41f4a28ac4d462487903229494eeb266f68a40","lessThan":"03c41203ee5a833a9d7a7630be190830cede29d8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/mac80211/status.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.18","status":"affected"},{"version":"0","lessThan":"6.18","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/03c41203ee5a833a9d7a7630be190830cede29d8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7f087f70e020b16a5b967332ee6e937817eaa173","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97512","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.100","lastModified":"2026-10-03T11:18:00.740","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nspi: spi-qcom-qspi: Fix incomplete error handling in runtime PM\n\nThe runtime PM functions had incomplete error handling that could leave the\nsystem in an inconsistent state. If any operation failed midway through\nsuspend or resume, some resources would be left in the wrong state while\nothers were already changed, leading to potential clock/power imbalances.\n\nReorder the suspend/resume sequences to avoid brownout risk by ensuring the\nperformance state is set appropriately before clocks are enabled and clocks\nare disabled before dropping the performance state.\n\nFix by adding proper error checking for all operations and using goto-based\ncleanup to ensure all successfully acquired resources are properly released\non any error."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/spi/spi-qcom-qspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"cff80645d6d3134260d2ef007a7decb1edcfd4a6","lessThan":"d9fa79ccd09204f626d382bdde1b8f5f4c5d03b3","versionType":"git","status":"affected"},{"version":"cff80645d6d3134260d2ef007a7decb1edcfd4a6","lessThan":"62dd3b8d3a92eb4e080b2ae491c2a5341654c1ee","versionType":"git","status":"affected"},{"version":"cff80645d6d3134260d2ef007a7decb1edcfd4a6","lessThan":"bb18a346271f87889bd64a3861c9a656a3509ea6","versionType":"git","status":"affected"},{"version":"cff80645d6d3134260d2ef007a7decb1edcfd4a6","lessThan":"d283d5d4d9f6d081ddb65e371be26fffeb611c42","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/spi/spi-qcom-qspi.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.9","status":"affected"},{"version":"0","lessThan":"5.9","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/62dd3b8d3a92eb4e080b2ae491c2a5341654c1ee","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bb18a346271f87889bd64a3861c9a656a3509ea6","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d283d5d4d9f6d081ddb65e371be26fffeb611c42","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d9fa79ccd09204f626d382bdde1b8f5f4c5d03b3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97513","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.210","lastModified":"2026-10-21T13:21:11.510","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Release m2m_ctx after Instance Removed from List\n\nPossible use after free if IRQ thread manages to obtain spinlock between\nm2m_ctx release and wave5_release function removing stream instance from\nlist of active instances. The IRQ thread looks for the m2m_ctx which is\nfreed so null pointer dereference occurs."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/chips-media/wave5/wave5-helper.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"0e6bdd437a3c7a5d8846d7f58fe9645a60ec0933","versionType":"git","status":"affected"},{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659","versionType":"git","status":"affected"},{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/chips-media/wave5/wave5-helper.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"references":[{"url":"https://git.kernel.org/stable/c/04cda0b5c4ca3f61cbc86e41ead3c462c8cfd659","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/0e6bdd437a3c7a5d8846d7f58fe9645a60ec0933","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cdbd7bb21949a8fda10c7104a2b12ee363cbf5c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97514","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.323","lastModified":"2026-09-28T06:16:37.423","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: chips-media: wave5: Fix Reports from Kernel Lock Validator\n\nhandle_dynamic_resolution change requires that the state_lock be acquired\nbased on the lockdep_assert_held. However, the\nhandle_dynamic_resolution_change call in initialize_sequence does not\nproperly obtain the lock before calling.\n\nSince the v4l2_ctrl_find and s_ctrl can sleep, they should not be called\nwhile a lock is already held. Store off the fbc_buf_count then properly\nupdate control once lock has been freed."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"629a937091ecf9c5c9f7a18f41cb0e6c778a7b2f","versionType":"git","status":"affected"},{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"072beef6a19f9c84dc5a50c5499663a5734c1096","versionType":"git","status":"affected"},{"version":"9707a6254a8a6b978bde811a44fe07d86c229d1c","lessThan":"7d5d364f8b2dcc9b6b92456fb55632fde4a4d96f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.8","status":"affected"},{"version":"0","lessThan":"6.8","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/072beef6a19f9c84dc5a50c5499663a5734c1096","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/629a937091ecf9c5c9f7a18f41cb0e6c778a7b2f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7d5d364f8b2dcc9b6b92456fb55632fde4a4d96f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97515","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.440","lastModified":"2026-10-21T13:21:11.650","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ni3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845\n\nOn NPCM845, when a target on the I3C bus gets stuck holding SDA low,\nthe controller reports a false Master Request (MR) in-band interrupt\nevent. The driver handles this by emitting a STOP condition to restore\nthe bus.\n\nHowever, the hardware quirk SVC_I3C_QUIRK_FALSE_SLVSTART indicates that\nemitting a STOP condition may spuriously set the SLVSTART interrupt\nstatus bit. In the Master Request case, this creates a feedback loop:\nthe STOP triggers a new SLVSTART event, the IRQ handler fires again,\nthe controller still reports an MR type, another STOP is emitted, and\nthe cycle repeats indefinitely, resulting in an IRQ storm that can lock\nup the CPU.\n\nClear the SLVSTART status bit explicitly after emitting the STOP in the\nMaster Request IBI handler when the SVC_I3C_QUIRK_FALSE_SLVSTART quirk\nis set. This breaks the feedback loop without affecting normal SLVSTART\nprocessing, which is already guarded in the top-level IRQ handler by\nchecking that MSTATUS is in SLVREQ state."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/i3c/master/svc-i3c-master.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"1ea4653cff35c29d1dd0b14ad9c8245e7318f337","lessThan":"335f72b1f9bbcf0f4cc5a505443b15f1af563b4f","versionType":"git","status":"affected"},{"version":"0430bf9bc1ac068c8b8c540eb93e5751872efc51","lessThan":"e9b139c4684ed8593a0b779ca02ea05f460b2eec","versionType":"git","status":"affected"},{"version":"0430bf9bc1ac068c8b8c540eb93e5751872efc51","lessThan":"1effa3adfe53cb2bb28bf5640a676b791d5ab405","versionType":"git","status":"affected"},{"version":"30748ce7e156f221fb91689b338a0d7df77b732a","versionType":"git","status":"affected"},{"version":"f2985a1de6f53abbc42c7a696ee6ba8bdecc9426","versionType":"git","status":"affected"},{"version":"0541822045ae043d62c941ca31fa76871e436b5e","versionType":"git","status":"affected"},{"version":"d231fb443d8d4042f0dd705b93beba8c916a7344","versionType":"git","status":"affected"},{"version":"6.12.31","lessThan":"6.12.114","versionType":"semver","status":"affected"},{"version":"5.15.185","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.141","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.6.93","lessThan":"6.7","versionType":"semver","status":"affected"},{"version":"6.14.9","lessThan":"6.15","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/i3c/master/svc-i3c-master.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.15","status":"affected"},{"version":"0","lessThan":"6.15","versionType":"semver","status":"unaffected"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1effa3adfe53cb2bb28bf5640a676b791d5ab405","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/335f72b1f9bbcf0f4cc5a505443b15f1af563b4f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e9b139c4684ed8593a0b779ca02ea05f460b2eec","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97516","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.550","lastModified":"2026-10-03T11:18:00.840","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()\n\nIt was recently reported that rtw_fw_adaptivity_result()\nin fw.c dereferences rtwdev->chip->edcca_th without\na NULL check. The issue is that devices with the\n8821CE chip don't define edcca_th in their chip\ninfo. As a result, when rtw_fw_adaptivity_result()\ntries to dereference it, the kernel triggers an oops.\n\nAdd a NULL check for edcca_th before dereferencing\nit in rtw_fw_adaptivity_result() in fw.c. Placing\nthe check at the function entry avoids logging any\ngarbage values.\n\nThis change does not address the root cause for\nthis behavior, but it prevents the NULL dereference\nand the resulting oops while a more permanent solution\nis developed.\n\nTested on a 8822CE chip which defines edcca_th, so\nthis issue is not present on it, but it still uses\nthis driver and I can verify there are no regressions."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/net/wireless/realtek/rtw88/fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"a8cdb18ef80d67790d8611ba94ae3d81901c9e04","versionType":"git","status":"affected"},{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d","versionType":"git","status":"affected"},{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"6fa23cafaf30f4877e357f8eebcff00dff4aa9cb","versionType":"git","status":"affected"},{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"1d1f250432cd8704c3c125168887f9724021c81a","versionType":"git","status":"affected"},{"version":"fe7bc23a8c5eba8a49061c1d15d0a9d45ef18130","lessThan":"d5e6f353ce1e1c25b8458ea390ed09d2377412c5","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/net/wireless/realtek/rtw88/fw.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.16","status":"affected"},{"version":"0","lessThan":"5.16","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0b58a5ac9170a6f5e6425f8e1a4b3e1d9c2bf53d","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1d1f250432cd8704c3c125168887f9724021c81a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6fa23cafaf30f4877e357f8eebcff00dff4aa9cb","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a8cdb18ef80d67790d8611ba94ae3d81901c9e04","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d5e6f353ce1e1c25b8458ea390ed09d2377412c5","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97517","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.670","lastModified":"2026-10-03T11:18:00.950","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: reject beacons with bad HE operation\n\nThe HE operation element not only needs to be longer than\nthe fixed part, but also have an appropriate size for the\nvariable part inside of it. Check this."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/nl80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"6e24f72985782013bf2feb0f0712b2ac9390e909","versionType":"git","status":"affected"},{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"8fe5eb7b68d76b3801409ada7365c67696e7af84","versionType":"git","status":"affected"},{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"6c4bb5450b9d9111faaaba581ea45a3a79844e50","versionType":"git","status":"affected"},{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"0d635f0b4a634eb599ed13a87ece0b5f129f9900","versionType":"git","status":"affected"},{"version":"7e8d6f12bb2a729290ebb0096248ea46d2868fc6","lessThan":"8b9a100e1a76c52988b31099b349fd95a58c8768","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/nl80211.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","versionType":"semver","status":"unaffected"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/0d635f0b4a634eb599ed13a87ece0b5f129f9900","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6c4bb5450b9d9111faaaba581ea45a3a79844e50","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6e24f72985782013bf2feb0f0712b2ac9390e909","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8b9a100e1a76c52988b31099b349fd95a58c8768","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/8fe5eb7b68d76b3801409ada7365c67696e7af84","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97518","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.787","lastModified":"2026-10-21T13:21:11.790","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: reject duplicate wiphy cipher suite entries\n\nDuplicate entries in wiphy->cipher_suites do not describe any\nadditional capability, but cfg80211 currently accepts them and leaves\nindividual consumers to deal with them.\n\nOne such consumer is the WEXT compatibility code, which appends a WEP\nkey length for each WEP cipher entry it sees. Repeated WEP entries can\ntherefore overflow the fixed iw_range::encoding_size array returned by\nSIOCGIWRANGE.\n\nReject duplicate cipher suite entries in wiphy_register() instead.\nThis keeps the cipher suite invariant in one place and makes malformed\nwiphy descriptions fail early with -EINVAL, rather than relying on a\nsingle cfg80211 user to handle duplicates correctly."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/wireless/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2ab658f9ce218ae93b3d2db2b3fe68bfefb81196","lessThan":"d12e92e72db914e1ea777c6f246f6be75985438e","versionType":"git","status":"affected"},{"version":"2ab658f9ce218ae93b3d2db2b3fe68bfefb81196","lessThan":"1305f8b925fe92edf5fec183588dfc7db719180b","versionType":"git","status":"affected"},{"version":"2ab658f9ce218ae93b3d2db2b3fe68bfefb81196","lessThan":"4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923","versionType":"git","status":"affected"},{"version":"2ab658f9ce218ae93b3d2db2b3fe68bfefb81196","lessThan":"7187d145d9042b037e4f10538f70cf95e380219f","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/wireless/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.32","status":"affected"},{"version":"0","lessThan":"2.6.32","versionType":"semver","status":"unaffected"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/1305f8b925fe92edf5fec183588dfc7db719180b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4cbb2360f4d8c29e67bc7a8bf6ba0ae096583923","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7187d145d9042b037e4f10538f70cf95e380219f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d12e92e72db914e1ea777c6f246f6be75985438e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97519","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:29.923","lastModified":"2026-09-28T06:16:37.937","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe: Fix null pointer dereference in devcoredump cleanup\n\nIn xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot\nwas never fully populated (e.g., when cleanup is triggered without a\nprior capture). Guard the xe_guc_capture_put_matched_nodes() call with\nIS_ERR_OR_NULL() to prevent a null dereference.\n\nIn xe_devcoredump_free(), the deferred work is only queued when a\ncoredump is captured, so guard cancel_work_sync() with a check on\ncoredump->captured."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["drivers/gpu/drm/xe/xe_devcoredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ecb6336463911d6eb684998754f8701d0f437f18","lessThan":"f5c3144f783f91d74b4fae84fb8bd7a4edf001f8","versionType":"git","status":"affected"},{"version":"ecb6336463911d6eb684998754f8701d0f437f18","lessThan":"12ef528d78adc8ea4e7e3db594f3bcac327e79fa","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["drivers/gpu/drm/xe/xe_devcoredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/12ef528d78adc8ea4e7e3db594f3bcac327e79fa","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f5c3144f783f91d74b4fae84fb8bd7a4edf001f8","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97520","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:30.050","lastModified":"2026-09-28T06:16:38.047","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: move quota_init qc iterator increment\n\nMove qc++ from the loop body into the for-loop increment\nexpression in gfs2_quota_init().\n\nThis keeps iterator progression explicit and avoids mixing pointer\nadvance with duplicate-slot handling in the loop body."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/gfs2/quota.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"04ec2f3b29b3c8a59950b8816b5ebc8ba052808a","versionType":"git","status":"affected"},{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"21a50a9373adab35ffadf5cf59272dc99078170e","versionType":"git","status":"affected"},{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"942202677f8f2ee448a6a2feb06aeeaf520342e3","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/gfs2/quota.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}]},"references":[{"url":"https://git.kernel.org/stable/c/04ec2f3b29b3c8a59950b8816b5ebc8ba052808a","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/21a50a9373adab35ffadf5cf59272dc99078170e","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/942202677f8f2ee448a6a2feb06aeeaf520342e3","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-97521","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","published":"2026-09-24T17:17:30.160","lastModified":"2026-09-28T06:16:38.160","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix quota init duplicate scan\n\ngfs2_quota_init() checks for duplicate quota_change IDs while holding\nqd_lock and the quota hash bucket bitlock. That path used\ngfs2_qd_search_bucket(), which takes a lockref reference via\nlockref_get_not_dead().\n\nOn PREEMPT_RT this may sleep, which is not allowed under the bucket\nbitlock, triggering \"sleeping function called from invalid context\".\n\nUse a no-ref bucket lookup in this path, then continue duplicate\nhandling without taking a lockref there.\n\nRefactor gfs2_qd_search_bucket() to build on top of the no-ref helper\nso lookup traversal stays in one place.\n\nThis patch fixes a bug reported by syzbot."}],"affected":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","affectedData":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/gfs2/quota.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"7fdcf16e5e14e11028f5bcaa6d25075eb5e876a0","versionType":"git","status":"affected"},{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"812a766e2b0a8f4d094393fad13475c57f5f86db","versionType":"git","status":"affected"},{"version":"de0d95c26c41c1776e4d23b1a8b3f2bcfd1dae5f","lessThan":"b99a1f0f18ee50445907f55069e88bcfd8947383","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/gfs2/quota.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","versionType":"semver","status":"unaffected"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]}],"metrics":{},"references":[{"url":"https://git.kernel.org/stable/c/7fdcf16e5e14e11028f5bcaa6d25075eb5e876a0","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/812a766e2b0a8f4d094393fad13475c57f5f86db","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b99a1f0f18ee50445907f55069e88bcfd8947383","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}},{"cve":{"id":"CVE-2026-54461","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:13.820","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"HabitRPG","product":"habitica","versions":[{"version":">= 4.172.1, < 5.48.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:57:09.073378Z","id":"CVE-2026-54461","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/HabitRPG/habitica/commit/7b7dc255dff1564935675399ff168e8a91b8afca","source":"security-advisories@github.com"},{"url":"https://github.com/HabitRPG/habitica/releases/tag/v5.48.2","source":"security-advisories@github.com"},{"url":"https://github.com/HabitRPG/habitica/security/advisories/GHSA-x772-22c9-gq58","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57175","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:14.523","lastModified":"2026-10-05T16:17:14.443","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued `AuthnRequest`. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account. The attacker could then authenticate through SAML and gain access to the victim's account. The issue affects applications using the SAML backend together with authenticated account association. The issue has been fixed in version 5.0.0 by validating SAML responses against stored `AuthnRequest` IDs."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:53:05.460192Z","id":"CVE-2026-57175","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-vq6g-g6c7-5f2j","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57176","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:14.680","lastModified":"2026-09-29T03:17:16.433","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table. A user from one shop could then be authenticated as the local account previously associated with the same numeric user ID from another shop. The issue affects applications using the Vend OAuth2 backend with more than one Vend shop. Version 5.0.0 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:58:12.222463Z","id":"CVE-2026-57176","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-289"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-fp7w-m676-w7gc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57177","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:14.823","lastModified":"2026-10-05T16:17:14.560","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token, making the victim authenticated as the attacker's LoginRadius identity. The issue affects only applications using the LoginRadius backend. The issue has been fixe in version 5.0.0 by enabling callback state validation for the LoginRadius backend."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:05.660534Z","id":"CVE-2026-57177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-x7qq-23vw-7pfg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57178","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:14.970","lastModified":"2026-09-28T18:17:23.873","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accepted VK application callback data without verifying the callback signature when the `auth_key` parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such as `viewer_id`, `access_token`, `api_id`, and `api_result`, potentially allowing authentication as an arbitrary VK user ID. The issue affects only applications using the `vk-app` backend. The issue has been fixed in version 5.0.0 by requiring `auth_key` to be present and valid before callback data is trusted."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T17:34:29.013431Z","id":"CVE-2026-57178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-3c93-f73f-qc9h","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-57179","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:15.120","lastModified":"2026-09-30T17:23:08.953","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume mechanism accepted `partial_token` as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow, obtain a valid partial token and verification data, and cause a victim's browser to resume that attacker-controlled flow. This could authenticate the victim's browser as the attacker's account. The issue affects applications using partial pipeline steps such as `mail_validation` or custom steps decorated with `@partial`. The issue has been fixed in version 5.0.0 by binding partial pipeline resumes to the originating browser session."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"python-social-auth","product":"social-core","versions":[{"version":"< 5.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:10:50.898479Z","id":"CVE-2026-57179","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-384"}]}],"references":[{"url":"https://github.com/python-social-auth/social-core/security/advisories/GHSA-vqg6-3fw6-j9jg","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61604","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:15.707","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The ixo Blockchain is a Layer 1 blockchain that runs on both Testnet and Mainnet. Prior to version 8.0.0, the x/bonds module moved funds from an address that was resolved from a DID verification method, without verifying that the resolved address belonged to the transaction signer. Affected handlers included MsgMakeOutcomePayment, MsgBuy, MsgSell, MsgSwap, and MsgWithdrawShare, as well as the batch order processor. Because any account may list an arbitrary blockchainAccountID as a verification method on a DID it controls (without the consent of that address's owner), an attacker could register victims' addresses as verification methods on their own DID and then move the victims' balances into a bond the attacker controlled — later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20. The attack required no victim keys, signatures, or system compromise — any account holding a balance in a token a bond could use was at risk. This was fixed in v8.0.0, delivered via the on-chain v8 software-upgrade. The x/bonds module is disabled: every bonds message is rejected on all routes (top-level, authz, CosmWasm, and ICA), and the bonds batch EndBlocker is a no-op so no further reserve movements can occur. All node operators and validators must upgrade to v8.0.0. The flaw is in chain state-machine logic and can only be remediated by running the patched binary. There is no application-level workaround. The vulnerability is in consensus logic; remediation requires the network to run the patched (v8.0.0) binary. The bonds module remains disabled in v8.0.0 and will only be re-enabled in a future release once the signer-authorization model has been corrected."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"ixofoundation","product":"ixo-blockchain","versions":[{"version":"< 8.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:02:22.273058Z","id":"CVE-2026-61604","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/ixofoundation/ixo-blockchain/security/advisories/GHSA-w3rp-4cm2-4wgc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61732","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:15.860","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"BitterSecurity","product":"Decepticon","versions":[{"version":"< 1.1.17","status":"affected"}]},{"vendor":"BitterSecurity","product":"decepticon-core","versions":[{"version":"< 1.1.17","status":"affected"}]},{"vendor":"BitterSecurity","product":"decepticon-sdk","versions":[{"version":"< 1.1.17","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:59:08.643777Z","id":"CVE-2026-61732","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://github.com/BitterSecurity/Decepticon/commit/79ee2aaf22f4c36a5b1968f6ca3f8086b6e35b67","source":"security-advisories@github.com"},{"url":"https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","source":"security-advisories@github.com"},{"url":"https://github.com/BitterSecurity/Decepticon/security/advisories/GHSA-g5f9-3xfg-p9mf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61741","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.013","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]` instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a `javax.xml.parsers.SAXParserFactory` obtained from `SAXParserFactory.newInstance` without any security configuration.  With the JDK's default settings, the parser resolves DOCTYPE declarations, external general and parameter entities, and external DTDs.An application that uses these decoders to parse untrusted XML is vulnerable to XML External Entity (XXE) attacks.  An attacker can craft a request that discloses local files readable by the service process, performs server-side request forgery (SSRF) against internal network resources, and/or causes denial of service through entity expansion. Versions 0.24.1 and 1.0.0-M39 fix the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"http4s","product":"http4s-scala-xml","versions":[{"version":"< 0.24.1","status":"affected"},{"version":">= 1.0.0-M1, < 1.0.0-M39","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:01:50.360279Z","id":"CVE-2026-61741","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-611"}]}],"references":[{"url":"https://github.com/http4s/http4s-scala-xml/security/advisories/GHSA-cjx3-73hr-rpw7","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61742","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.173","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP endpoint when started with the documented HTTP transport mode, for example `--transport http --port 8080`. The HTTP server attempts to protect browser-origin access by checking whether the `Origin` hostname equals the `Host` hostname, then reflecting the validated `Origin` into `Access-Control-Allow-Origin`. This does not stop DNS rebinding. After an attacker-controlled hostname rebinds to a victim-accessible DBHub HTTP server, both `Origin` and `Host` can contain the attacker-controlled hostname, so DBHub accepts the request and dispatches MCP tool calls. As a result, a malicious website can deterministically invoke DBHub MCP tools from the victim's browser without prompt injection or model involvement. With the default demo configuration this can read and write the demo SQLite database; with a real configured database, the same primitive can read, enumerate, and potentially write database contents depending on DBHub's configured tool permissions and database credentials. Version 0.22.5 fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bytebase","product":"dbhub","versions":[{"version":"< 0.22.5","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:42:02.587147Z","id":"CVE-2026-61742","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-346"}]}],"references":[{"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w","source":"security-advisories@github.com"},{"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-fm8p-53ww-hf6w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61782","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.333","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (`moduleCodeMap`), serialized build configuration (`configs`), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer. Version 1.5.16 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"web-infra-dev","product":"rsdoctor","versions":[{"version":"< 1.5.16","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:59:04.166140Z","id":"CVE-2026-61782","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3","source":"security-advisories@github.com"},{"url":"https://github.com/web-infra-dev/rsdoctor/security/advisories/GHSA-jmg2-rcxh-w8q3","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61784","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.640","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing its sanitized output. In attributeString() (XHTMLPurifier.js, around line 148) the attribute value is concatenated directly into a double-quoted attribute without encoding. As a result, an attacker-controlled value in any allowed attribute (class, style, title, alt, src, href) can include a double-quote character to break out of the attribute and inject an additional attribute, such as a JavaScript event handler (for example onmouseover or onerror). The injected handler survives sanitization and executes when the output is rendered, which is a sanitizer bypass leading to cross-site scripting. The fix in version 0.4.3 HTML-entity-encodes attribute values before serialization."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"cstigler","product":"node-xhtml-purifier","versions":[{"version":"< 0.4.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:02:51.787487Z","id":"CVE-2026-61784","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/cstigler/node-xhtml-purifier/commit/21d461ad23e7bc9b3073693d5b51b9b8662044d3","source":"security-advisories@github.com"},{"url":"https://github.com/cstigler/node-xhtml-purifier/security/advisories/GHSA-j8r4-32c5-33rc","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61788","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.837","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the `execute_sql` tool does not make the connection read-only. The connectors are written to set PostgreSQL `default_transaction_read_only=on` (and open SQLite in `readOnly` mode), but that code is gated on a config value that is never populated, so it never runs. The only thing left enforcing read-only is a classifier that inspects the first keyword of each statement. Any `SELECT` that writes or has side effects through a function call passes it. With an ordinary role this allows sequence tampering; with a privileged role it allows writing arbitrary files on the server (`lo_export`), reading arbitrary host files (`pg_read_file`), and remote code execution (`dblink` + `COPY ... TO PROGRAM`). The HTTP transport is unauthenticated and binds to `0.0.0.0` by default, so this is reachable by any network caller of `/mcp`. Version 0.22.6 patches the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"bytebase","product":"dbhub","versions":[{"version":"< 0.22.6","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:00:20.390455Z","id":"CVE-2026-61788","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-184"},{"lang":"en","value":"CWE-636"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf","source":"security-advisories@github.com"},{"url":"https://github.com/bytebase/dbhub/security/advisories/GHSA-mwwr-p57h-56pf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61811","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:16.990","lastModified":"2026-09-30T16:44:39.840","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers in each stack frame. An enrolled agent can submit a Windows EventChannel event containing an element with enough attributes to exhaust the analysisd worker-thread stack, trigger a segmentation fault, and interrupt log ingestion. The element-depth limit in _ReadElem() does not constrain the number of attributes on one element, so it does not prevent this condition. This issue is fixed in version 4.14.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"wazuh","product":"wazuh","versions":[{"version":">= 3.8.0, < 4.14.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:02:16.205270Z","id":"CVE-2026-61811","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://github.com/wazuh/wazuh/commit/2ac70941c5980a5dd24ad8a0f2be559f840e6a67","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/pull/37147","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.7","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-9wv5-7qwx-m9w5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61815","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:17.153","lastModified":"2026-10-05T16:17:14.673","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Prior to version 3.0.6 and 4.0.2, CRLF (carriage-return / line-feed) header injection (CWE-93) affecting any application that uses this library to build or forward MIME messages with an attacker-influenced attachment filename. Attachment filenames are interpolated into the `Content-Type` and `Content-Disposition` header values without stripping CR/LF, so a filename containing `\\r\\n` serializes as one or more additional, attacker-controlled header lines (for example a forged `Bcc:` that silently exfiltrates a copy of the outgoing message). The untrusted filename can come directly from parsed inbound mail, so no local construction is required — an application that re-attaches or re-sends a parsed filename is exposed. Versions 3.0.6 and 4.0.2 patch the issue. Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. If upgrading is not immediately possible, strip CR and LF from any filename before passing it to attachment APIs, and from the result of getFilename() before reusing it in a constructed message — e.g. preg_replace('/[\\r\\n]+/', ' ', $filename)."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zbateson","product":"mail-mime-parser","versions":[{"version":"< 3.0.6","status":"affected"},{"version":">= 4.0.0, < 4.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:51:02.739548Z","id":"CVE-2026-61815","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-93"}]}],"references":[{"url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-36h5-qg4p-q2qf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61816","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:17.303","lastModified":"2026-09-30T17:32:07.107","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Message Format RFC 822. Starting in version 2.0.0 and prior to version 3.0.6 and 4.0.2, an uncontrolled resource consumption / algorithmic complexity vulnerability (CWE-400) affects any application that parses untrusted email with this library. Three independent parsing paths are super-linear in cost, so a byte-size cap on the caller side does **not** bound the work done.  A crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory (leading to an out-of-memory kill), enabling denial of service. The parse is lazy, but the cost is paid on the first `getAllParts()` or content read. This is fxed in 4.0.2 and 3.0.6. The fixes add configurable limits on multipart nesting depth and on header count / total header size (recording a parse error past the threshold rather than throwing), and change sibling append to O(n). Users should upgrade to one of these (or later) versions. Versions 2.x are also affected but are end-of-life and will not receive patches; users on those lines should upgrade to a fixed release. (Versions prior to 2.0 used a different parser and are not affected by all three paths.) These costs are super-linear, so an input byte-size cap alone does not bound them. Until upgrading, restrict exposure of the parser to untrusted input, and run parsing under a constrained memory_limit and execution time limit so a malicious message fails its own request rather than exhausting the host."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zbateson","product":"mail-mime-parser","versions":[{"version":">= 2.0.0, < 3.0.6","status":"affected"},{"version":">= 4.0.0, < 4.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:11:24.169203Z","id":"CVE-2026-61816","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx","source":"security-advisories@github.com"},{"url":"https://github.com/zbateson/mail-mime-parser/security/advisories/GHSA-f6v3-2qmr-vfjx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-63645","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:17:19.053","lastModified":"2026-10-05T16:17:14.793","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentication and serializes the complete server configuration after applying the hide_sensitive_fields keyword filter. The filter does not recognize dsn or creds field names, so meta_postgres_dsn, meta_postgres_ro_dsn, meta_ddl_dsn, and usage_reporting_creds can be returned in plaintext to an unauthenticated network client. PostgreSQL deployments can expose database credentials, and the same response can disclose the root administrator email address, internal NATS address, filesystem layout, and other deployment details. This issue is fixed in version 0.90.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"openobserve","product":"openobserve","versions":[{"version":"< 0.90.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:51:04.523036Z","id":"CVE-2026-63645","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://github.com/openobserve/openobserve/commit/4f3db1cf790ffe8ea065d98f87344e839ec6e477","source":"security-advisories@github.com"},{"url":"https://github.com/openobserve/openobserve/pull/12220","source":"security-advisories@github.com"},{"url":"https://github.com/openobserve/openobserve/releases/tag/v0.90.3","source":"security-advisories@github.com"},{"url":"https://github.com/openobserve/openobserve/security/advisories/GHSA-v496-g5c9-vqxw","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-71540","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:18:31.340","lastModified":"2026-09-30T19:38:27.293","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before Fernet decryption validates the peer. An unauthenticated network peer can declare a payload of up to 256 MiB, stop sending after the header, and retain that allocation until the TCP connection closes. The cluster listener has no application-level per-source connection budget in affected versions, allowing concurrent sockets to multiply memory consumption and potentially terminate the cluster process, disrupt synchronization, and interrupt distributed API forwarding. This issue is fixed in version 4.14.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"wazuh","product":"wazuh","versions":[{"version":">= 3.9.0, < 4.14.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T15:01:49.339177Z","id":"CVE-2026-71540","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/wazuh/wazuh/commit/9a996bc23d28725f6c1f8f7808355d90e20d3382","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/pull/37280","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/releases/tag/v4.14.7","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-78wx-4r6w-w73f","source":"security-advisories@github.com"},{"url":"https://github.com/wazuh/wazuh/security/advisories/GHSA-78wx-4r6w-w73f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-81508","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:18:57.503","lastModified":"2026-09-25T13:17:26.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the received media buffer before validating that the packet layout contains the field. A paired BR/EDR audio source within radio range can send a malformed A2DP media packet to a build with BlueDroid Classic Bluetooth and A2DP sink support enabled, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents. Arbitrary memory disclosure and code execution are not established."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"espressif","product":"esp-idf","versions":[{"version":"= 6.1","status":"affected"},{"version":"= 6.0.1","status":"affected"},{"version":"= 5.5.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:06:01.831759Z","id":"CVE-2026-81508","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://github.com/espressif/esp-idf/commit/0d118139ff8b7aa87b656c2f4a6421ecaa1f5939","source":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/6cb20db4dfeee81314d0c55acb82f3f0e7679abe","source":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/85d56bcd266117e0fe6a6b75511c8e122fda29ad","source":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/commit/ca55d63de82e41e2c672bfd2b707fc80911f30ce","source":"security-advisories@github.com"},{"url":"https://github.com/espressif/esp-idf/security/advisories/GHSA-xcpr-5mqp-9qvv","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-85056","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:04.040","lastModified":"2026-09-28T15:17:24.163","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zitadel","product":"zitadel","versions":[{"version":">= 4.0.0, < 4.16.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:55:51.988985Z","id":"CVE-2026-85056","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://github.com/zitadel/zitadel/commit/049dbb25a56587fb3980c85c99819cad69f637db","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/commit/56f4798ed31fc1cfcd9a0e7f6f0152289d2fdc43","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/releases/tag/v4.16.1","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-9993-rfwp-rhwf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-85057","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:04.217","lastModified":"2026-10-05T16:17:16.690","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"zitadel","product":"zitadel","versions":[{"version":">= 3.0.0, < 3.4.13","status":"affected"},{"version":">= 4.0.0, < 4.16.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:53:03.930118Z","id":"CVE-2026-85057","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/releases/tag/v3.4.13","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/releases/tag/v4.16.1","source":"security-advisories@github.com"},{"url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91119","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:06.220","lastModified":"2026-09-28T16:17:16.950","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:59:51.871193Z","id":"CVE-2026-91119","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/20dbf112760eb1d6a58f2e49aeef7546898b6f1c","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/66653c484cfb91bc346f9a326f6945387f17b035","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/77a81c7a3a7ff9e94b355e32b8f379f2d389e05a","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/c4748f651d9d2f3a6dd3106a4d5564536c645168","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-pv3p-p3m9-v8v3","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91120","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:06.397","lastModified":"2026-09-24T18:19:06.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:24:51.329319Z","id":"CVE-2026-91120","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/6bf1cdcb3ae1aa146e1fd953a62046bf4a1f143f","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/8338919df4ecbd0fb85314b762772cc033b764e3","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/e7de8285203a2edf85beff3b951e66aeb7e5dc76","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/ed8b47df80bcc9f0bd70773fc399c9386f9d52dd","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-h7cg-2vww-m45c","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-91121","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:06.583","lastModified":"2026-09-24T18:19:06.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"discourse","product":"discourse","versions":[{"version":"< 2026.8.0","status":"affected"},{"version":">= 2026.7.0-latest, < 2026.7.2","status":"affected"},{"version":">= 2026.6.0-latest, < 2026.6.3","status":"affected"},{"version":">= 2026.1.0-latest, < 2026.1.8","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:27:35.450393Z","id":"CVE-2026-91121","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/discourse/discourse/commit/24cd7cc4c868f20e6037d67d801d60c3e289b278","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/6e7a181909c34a059d2b0a6291335a363205b787","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/9d6f5e64a1cb68e8208520e4209b361e14f7394b","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/commit/af197941f7613a3845cba21d217641c77c8ef836","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/pull/42882","source":"security-advisories@github.com"},{"url":"https://github.com/discourse/discourse/security/advisories/GHSA-34rh-wjfv-65gq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-93405","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T18:19:07.120","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Foundry376","product":"Mailspring","versions":[{"version":"< 1.17.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:02:37.474456Z","id":"CVE-2026-93405","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/Foundry376/Mailspring/commit/5728388199666ec0a9a58f693c89c25b948a9b6c","source":"security-advisories@github.com"},{"url":"https://github.com/Foundry376/Mailspring/pull/2523","source":"security-advisories@github.com"},{"url":"https://github.com/Foundry376/Mailspring/releases/tag/1.17.0","source":"security-advisories@github.com"},{"url":"https://github.com/Foundry376/Mailspring/security/advisories/GHSA-px2g-jhg5-c6gh","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-95985","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-09-24T18:19:08.357","lastModified":"2026-09-24T19:36:39.327","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths.\n\n\n\nWe recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"Amazon","product":"Kiro IDE","defaultStatus":"unaffected","platforms":["MacOS","Windows","Linux"],"versions":[{"version":"0","lessThan":"1.0.242","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:23:54.377945Z","id":"CVE-2026-95985","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-349"},{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-117-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://kiro.dev/changelog/ide/1-0-242/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}]}},{"cve":{"id":"CVE-2026-97232","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T18:19:09.217","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file_content/move_files/start_streaming of the file page.html. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"volotat","product":"Anagnorisis","cpes":["cpe:2.3:a:volotat:anagnorisis:*:*:*:*:*:*:*:*"],"versions":[{"version":"0.4.0","status":"affected"},{"version":"0.4.1","status":"affected"},{"version":"0.4.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T17:28:23.995827Z","id":"CVE-2026-97232","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://note-hxlab.wetolink.com/share/O7wlVHed7mQd","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97232","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908266","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409322","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409322/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97233","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T18:19:09.410","lastModified":"2026-10-05T16:17:18.033","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.js of the component Media Filename Handler. Such manipulation of the argument file_path leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"volotat","product":"Anagnorisis","cpes":["cpe:2.3:a:volotat:anagnorisis:*:*:*:*:*:*:*:*"],"modules":["Media Filename Handler"],"versions":[{"version":"0.4.0","status":"affected"},{"version":"0.4.1","status":"affected"},{"version":"0.4.2","status":"affected"},{"version":"0.4.3","status":"affected"},{"version":"0.4.4","status":"affected"},{"version":"0.4.5","status":"affected"},{"version":"0.4.6","status":"affected"},{"version":"0.4.7","status":"affected"},{"version":"0.4.8","status":"affected"},{"version":"0.4.9","status":"affected"},{"version":"0.4.10","status":"affected"},{"version":"0.4.11","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","baseScore":3.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","baseScore":4.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:05:15.350333Z","id":"CVE-2026-97233","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://note-hxlab.wetolink.com/share/qA4ZLotZKWmj","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97233","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908267","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409323","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409323/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-13016","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:11.820","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. \n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:13:52.621840Z","id":"CVE-2026-13016","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-13248","sourceIdentifier":"psirt@honeywell.com","published":"2026-09-24T19:17:12.917","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows an authenticated user with access to the admin or itadmin account to submit commands written in the Intermec Fingerprint programming language directly to the printer ’s internal command interpreter. \n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."}],"affected":[{"source":"psirt@honeywell.com","affectedData":[{"vendor":"Honeywell","product":"PD45 Industrial Printer","defaultStatus":"unaffected","versions":[{"version":"F10.19.010040","lessThan":"F10.22.030745","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@honeywell.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:19:35.275464Z","id":"CVE-2026-13248","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@honeywell.com","type":"Secondary","description":[{"lang":"en","value":"CWE-73"},{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://www.honeywell.com/us/en/legal/product-security#security-notices","source":"psirt@honeywell.com"}]}},{"cve":{"id":"CVE-2026-13249","sourceIdentifier":"psirt@honeywell.com","published":"2026-09-24T19:17:13.080","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication.\n\n\nAn attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability."}],"affected":[{"source":"psirt@honeywell.com","affectedData":[{"vendor":"Honeywell","product":"PD45 Industrial Printer","defaultStatus":"unaffected","versions":[{"version":"F10.19.010040","lessThan":"F10.22.030745","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@honeywell.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:37:57.888525Z","id":"CVE-2026-13249","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@honeywell.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://www.honeywell.com/us/en/legal/product-security#security-notices","source":"psirt@honeywell.com"}]}},{"cve":{"id":"CVE-2026-48070","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:13.430","lastModified":"2026-10-05T16:17:13.640","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":"< 0.80.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:02.411616Z","id":"CVE-2026-48070","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.80.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-95f8-h5hf-8248","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-48072","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:13.597","lastModified":"2026-09-24T19:17:13.730","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated attacker can traverse outside the avatar or logo directory and read local storage objects whose final basename satisfies the route's UUID check. This issue is fixed in version 0.80.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":"< 0.80.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:47:04.473169Z","id":"CVE-2026-48072","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/commit/ec83fc82d54bf3728eaa63b20eb4abcb5aef1d97","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.80.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-9f58-29hm-mgp2","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-48073","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:13.767","lastModified":"2026-09-24T20:17:29.000","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting the attacker-controlled page with includeAttachments=true causes the page export flow to read the restricted attachment from storage and include it in the returned ZIP archive even though direct file download denies access. This issue is fixed in version 0.80.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":">= 0.70.0, < 0.80.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:23:15.132872Z","id":"CVE-2026-48073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/a573acedd0317f3472cb0f8b95f6aa15315312e5","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.80.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-rxm9-xp9h-4c84","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-52850","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:13.930","lastModified":"2026-09-29T04:17:56.370","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair because the lookup does not enforce private space membership before resolving the source page. The API can return confidential sync-block content and source page metadata even though the normal page APIs deny access to the same page. This issue is fixed in version 0.90.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":"< 0.90.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:08:11.300076Z","id":"CVE-2026-52850","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/830b5b4d458a1302f42c8b68bff9ff559f6eb342","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.90.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-5vhf-cgf2-c9cq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-52853","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:14.100","lastModified":"2026-10-05T16:17:14.100","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges above their own. When the invitation is accepted, the new account receives OWNER-level permissions, allowing the ADMIN to create a backdoor OWNER account or promote a colluding external user to the workspace's highest privilege level. This issue is fixed in version 0.90.1."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":"< 0.90.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N","baseScore":5.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:00.477232Z","id":"CVE-2026-52853","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/33895b060790358869f54ae451c3848480b39503","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/pull/2250","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.90.1","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-84fx-mvqx-p5gx","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-56792","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T19:17:14.290","lastModified":"2026-09-29T04:17:56.743","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Rugged Control Center (RCC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.2.206","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T00:00:00+00:00","id":"CVE-2026-56792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506924/dsa-2026-410-security-update-for-dell-rugged-control-center-rcc-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-57440","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:14.630","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"StarCitizenWiki","product":"mediawiki-extensions-EmbedVideo","versions":[{"version":"< 4.1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:08:51.593598Z","id":"CVE-2026-57440","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-80"}]}],"references":[{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/commit/370156335b325bb81d14d89edf0a1f2643d50a84","source":"security-advisories@github.com"},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c","source":"security-advisories@github.com"},{"url":"https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/security/advisories/GHSA-v65j-hff3-753c","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-61823","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:15.350","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the `srcdoc` attribute on iframe elements. Although markup inside `srcdoc` is HTML-encoded during sanitization, browsers decode attribute entities before interpreting the iframe document, allowing an authenticated user with permission to edit an Editor field to store executable JavaScript that runs when another user views the content. Successful exploitation can result in session hijacking, unauthorized actions, account takeover, privilege escalation, or disclosure of administrative data. Version 9.22.5 patches the vulnerability by removing `srcdoc` from the permitted iframe attributes. As a workaround, applications that cannot upgrade should manually sanitize all Editor field content and remove every iframe `srcdoc` attribute before storing or rendering it."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"code16","product":"sharp","versions":[{"version":"< 9.22.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:27:39.971450Z","id":"CVE-2026-61823","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21","source":"security-advisories@github.com"},{"url":"https://github.com/code16/sharp/security/advisories/GHSA-qxg3-46rw-79j8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61825","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:15.500","lastModified":"2026-09-29T19:07:47.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in `SharpEditorFormField`: attacker-controlled content bearing the `data-html-content` attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. The vendor identifies version 9.22.5 as patched; applications that intentionally enable `SharpFormEditorField::RAW_HTML` must continue to sanitize editor content themselves. As a workaround, applications should sanitize all editor content before storing or rendering it, for example with Symfony HtmlSanitizer, and disable RAW_HTML functionality where it is not required."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"code16","product":"sharp","versions":[{"version":"< 9.22.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:53:19.093005Z","id":"CVE-2026-61825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/code16/sharp/commit/ec509a22c808a5bd9dfad6a0a85c92ce6f411e21","source":"security-advisories@github.com"},{"url":"https://github.com/code16/sharp/security/advisories/GHSA-vj3q-vp3g-j9c8","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-62286","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:15.657","lastModified":"2026-09-30T19:57:08.043","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment using per-user filters, any authenticated restricted account can receive resource telemetry and lifecycle events for containers outside its authorized label scope. The exposed data includes container names, images, full label maps, CPU and memory use, network and disk totals, and deployment or restart activity across monitored hosts, but does not include log contents, environment values, or exec access. This issue is fixed in version 10.6.7."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"amir20","product":"dozzle","versions":[{"version":"< 10.6.7","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:53:09.722694Z","id":"CVE-2026-62286","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://github.com/amir20/dozzle/commit/19c01e0fb491c170796edba3da2692562c204e77","source":"security-advisories@github.com"},{"url":"https://github.com/amir20/dozzle/pull/4803","source":"security-advisories@github.com"},{"url":"https://github.com/amir20/dozzle/releases/tag/v10.6.7","source":"security-advisories@github.com"},{"url":"https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj","source":"security-advisories@github.com"},{"url":"https://github.com/amir20/dozzle/security/advisories/GHSA-xcw9-qmmf-vqxj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-65827","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:15.947","lastModified":"2026-09-24T20:17:29.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated workspace member with edit rights to a space can upload an archive to the page-import feature whose ZIP extraction routine does not limit total uncompressed size, per-entry size, or entry count. The extractor writes entries to the server temp directory and automatically extracts one nested ZIP, allowing an outer upload within the default 200 MB limit to expand by multiple GB. The resulting disk exhaustion can crash the import worker and degrade or take down the instance for all tenants. This issue is fixed in version 0.95.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"docmost","product":"docmost","versions":[{"version":">= 0.21.0, < 0.95.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:22:03.264160Z","id":"CVE-2026-65827","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-409"},{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/docmost/docmost/commit/04110884b4e90a43cc5b337e063d0b7493be5da7","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/releases/tag/v0.95.0","source":"security-advisories@github.com"},{"url":"https://github.com/docmost/docmost/security/advisories/GHSA-frjw-66gr-799m","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-77293","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:16.397","lastModified":"2026-09-25T13:17:26.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment. Sequential identifiers make broad targeting practical, while attachment read operations remain trip-scoped and are not affected. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mauriceboe","product":"TREK","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:44:45.227942Z","id":"CVE-2026-77293","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-639"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1520","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-cjc5-722j-vvmf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77294","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:16.570","lastModified":"2026-09-25T13:17:26.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. Write permission to the target trip instance is required to trigger the vulnerable AI-assisted import path. The value is consumed by the clients in server/src/nest/llm-parse/clients/openai-compatible.client.ts, server/src/nest/llm-parse/clients/anthropic.client.ts, and server/src/nest/llm-parse/router/ollama-format.client.ts without applying the server-side request forgery guard. Triggering AI-assisted trip parsing causes the server to request the supplied destination, and upstream error response text can be returned in parsing warnings. This permits internal service discovery and access to link-local cloud metadata, with possible disclosure of infrastructure credentials and subsequent modification of protected cloud resources. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mauriceboe","product":"TREK","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:35:19.739164Z","id":"CVE-2026-77294","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1520","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-fmq9-ggh3-647p","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-fmq9-ggh3-647p","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77320","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:16.730","lastModified":"2026-09-29T04:17:58.450","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mauriceboe","product":"TREK","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:05:11.522637Z","id":"CVE-2026-77320","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-602"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1520","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-9hc8-p7gm-p7mx","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77321","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:16.887","lastModified":"2026-10-05T16:17:16.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped OAuth MCP tokens without requiring trips:read and returns core trip summary data regardless of the delegated scopes. A token granted only an unrelated capability, such as weather:read, can receive trip metadata, member email addresses from server/src/services/tripService.ts, itinerary days, and accommodations for every trip accessible to the token's user. Cross-user trip authorization remains enforced, but the missing scope check defeats the consented least-privilege boundary and exposes trip content and third-party contact information to an MCP client that was not authorized to read it. This issue is fixed in version 3.3.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"mauriceboe","product":"TREK","versions":[{"version":"< 3.3.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T14:47:04.222887Z","id":"CVE-2026-77321","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"},{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/19064b39176660f3be3a2df198c87949504046e2","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1520","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.3.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-qvw8-w937-vcmq","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-81455","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T19:17:17.463","lastModified":"2026-09-24T19:37:47.987","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"ThinOS 10","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"SecurityAddon_2605.10.2766_T10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:54:04.557564Z","id":"CVE-2026-81455","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Primary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506503/dsa-2026-404-security-update-for-dell-thinos-10-for-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-81473","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T19:17:17.607","lastModified":"2026-09-29T04:17:58.820","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Rugged Control Center (RCC)","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.2.206","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T00:00:00+00:00","id":"CVE-2026-81473","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506924/dsa-2026-410-security-update-for-dell-rugged-control-center-rcc-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-82157","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T19:17:17.917","lastModified":"2026-09-25T04:17:48.060","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Protection mechanism bypass and Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"ThinOS 10","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"SecurityAddon_2605.10.2766_T10","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-82157","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506503/dsa-2026-404-security-update-for-dell-thinos-10-for-multiple-vulnerabilities","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-82371","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T19:17:18.047","lastModified":"2026-10-01T21:17:25.773","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed authentication details to compromise managed network infrastructure and access active application sessions. This vulnerability affects Brocade SANnav versions before 3.0.1a."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"before","lessThan":"3.0.1a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.0.1a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:37:39.127028Z","id":"CVE-2026-82371","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38996","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-85738","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T19:17:18.193","lastModified":"2026-09-28T15:17:24.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"liketrek","product":"TREK","versions":[{"version":"< 3.4.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-28T14:51:50.053724Z","id":"CVE-2026-85738","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/liketrek/TREK/commit/a2bd9be184a94997105ce190dad920c41e7b10df","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/pull/1540","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/releases/tag/v3.4.0","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-9hpq-mrpx-mcxg","source":"security-advisories@github.com"},{"url":"https://github.com/liketrek/TREK/security/advisories/GHSA-9hpq-mrpx-mcxg","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-86857","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:18.350","lastModified":"2026-09-25T13:17:16.663","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access, potentially enabling further unintended access.\n\n\n\n\n\nServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:46:00.486580Z","id":"CVE-2026-86857","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-86858","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:18.483","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended.\n\n\n\n\n\nIn August 2026, ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:14:16.789932Z","id":"CVE-2026-86858","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-86859","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:18.603","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access, potentially enabling further unintended access.\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:12:32.855907Z","id":"CVE-2026-86859","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-86860","sourceIdentifier":"psirt@servicenow.com","published":"2026-09-24T19:17:18.733","lastModified":"2026-09-25T04:17:48.557","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting in privilege escalation.\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."}],"affected":[{"source":"psirt@servicenow.com","affectedData":[{"vendor":"ServiceNow","product":"ServiceNow AI Platform","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"Yokohama Patch 13 Hot Fix 5a","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 3b","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 10 Hot Fix 4a W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Zurich Patch 11 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 2 Hot Fix 4b W32","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 4 Hot Fix 3","versionType":"custom","status":"affected"},{"version":"0","lessThan":"Australia Patch 5","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@servicenow.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T00:00:00+00:00","id":"CVE-2026-86860","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623","source":"psirt@servicenow.com"}]}},{"cve":{"id":"CVE-2026-89325","sourceIdentifier":"cve@rapid7.com","published":"2026-09-24T19:17:19.580","lastModified":"2026-09-26T04:17:49.963","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH.\n\nAssessment content at or below version 0.0.261.0 included a check that invoked the `code` command without a fully qualified path from a process running as SYSTEM. The command was resolved against the machine PATH environment variable at execution time. Where the machine PATH contained a directory writable by non-administrative users and ordered ahead of the legitimate Visual Studio Code installation, a local user could place an executable named `code` in that directory and cause the agent to execute it with SYSTEM privileges.\n\nThe version range above refers to InsightVM assessment content versions, not Insight Agent versions. All Insight Agent versions were affected while running assessment content at or below 0.0.261.0. Assessment content is delivered to all Insight Agents via the Rapid7 Insight Platform independently of the Insight Agent version and is not customer-managed.\n\nThis issue was resolved in assessment content version 0.0.269.0, which was made generally available on September 15, 2026. Remediation was deployed automatically and no customer action is required."}],"affected":[{"source":"cve@rapid7.com","affectedData":[{"vendor":"Rapid7","product":"Insight Agent","defaultStatus":"unaffected","modules":["InsightVM assessment content"],"platforms":["Windows"],"versions":[{"version":"0","lessThanOrEqual":"0.0.261.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@rapid7.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-89325","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@rapid7.com","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"references":[{"url":"https://docs.rapid7.com/insight/release-notes-2026-september/#resolved-cve-2026-89325","source":"cve@rapid7.com"}]}},{"cve":{"id":"CVE-2026-96747","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T19:17:20.650","lastModified":"2026-09-24T21:04:40.340","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in \".sock\" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Python Driver","defaultStatus":"unaffected","versions":[{"version":"3.9.0","lessThan":"4.18.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:36:00.653378Z","id":"CVE-2026-96747","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96748","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T19:17:20.813","lastModified":"2026-09-24T21:00:46.893","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Python Driver","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.18.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:36:30.450714Z","id":"CVE-2026-96748","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-177"}]}],"references":[{"url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-96749","sourceIdentifier":"cna@mongodb.com","published":"2026-09-24T19:17:20.963","lastModified":"2026-09-26T04:17:52.260","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer inside the application's own process."}],"affected":[{"source":"cna@mongodb.com","affectedData":[{"vendor":"MongoDB","product":"Python Driver","defaultStatus":"unaffected","versions":[{"version":"1.9.0","lessThan":"4.18.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@mongodb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-96749","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@mongodb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-190"}]}],"references":[{"url":"https://github.com/mongodb/mongo-python-driver/blob/4.18.2/doc/changelog.rst","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/releases/tag/4.18.2","source":"cna@mongodb.com"},{"url":"https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv","source":"cna@mongodb.com"}]}},{"cve":{"id":"CVE-2026-97320","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T19:17:21.247","lastModified":"2026-09-25T15:17:57.377","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["AI Knowledge Module"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["AI Knowledge Module"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:05:03.509294Z","id":"CVE-2026-97320","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97320","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908270","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409328","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409328/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908270","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97321","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T19:17:21.430","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoView Data Endpoint. Such manipulation of the argument sql leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["GoView Data Endpoint"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["GoView Data Endpoint"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T18:50:44.044955Z","id":"CVE-2026-97321","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Primary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97321","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908272","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409329","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409329/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908272","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97322","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T19:17:21.637","lastModified":"2026-09-29T04:18:02.747","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileController.java of the component File Upload. Performing a manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["File Upload"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["File Upload"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:09:38.965416Z","id":"CVE-2026-97322","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97322","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908273","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409330","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409330/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97323","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T19:17:21.820","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["File Upload"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["File Upload"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:24:30.726394Z","id":"CVE-2026-97323","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97323","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908274","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409331","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409331/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908274","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-48540","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:29.117","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected lead record."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","defaultStatus":"unknown","repo":"https://github.com/krayin/laravel-crm","packageURL":"pkg:github/krayin/laravel-crm","versions":[{"version":"0","lessThanOrEqual":"2.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:35:00.774527Z","id":"CVE-2026-48540","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-lead-title","source":"disclosure@vulncheck.com"},{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48540","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-48541","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:29.287","lastModified":"2026-09-30T18:18:37.073","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected person record."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","defaultStatus":"unknown","repo":"https://github.com/krayin/laravel-crm","packageURL":"pkg:github/krayin/laravel-crm","versions":[{"version":"0","lessThanOrEqual":"2.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-30T15:43:46.646473Z","id":"CVE-2026-48541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-contact-name-field","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-48542","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:29.433","lastModified":"2026-09-29T04:17:56.023","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected product record."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","defaultStatus":"unknown","repo":"https://github.com/krayin/laravel-crm","packageURL":"pkg:github/krayin/laravel-crm","versions":[{"version":"0","lessThanOrEqual":"2.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:10:16.233438Z","id":"CVE-2026-48542","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-product-name-field","source":"disclosure@vulncheck.com"},{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-48543","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:29.573","lastModified":"2026-09-25T18:17:25.943","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form description containing double-brace template syntax that reaches the Vue template compiler, enabling prototype chain traversal to retrieve the Function constructor and execute attacker-supplied JavaScript in the application origin for every user who views the affected web form."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"krayin","product":"laravel-crm","defaultStatus":"unknown","repo":"https://github.com/krayin/laravel-crm","packageURL":"pkg:github/krayin/laravel-crm","versions":[{"version":"0","lessThanOrEqual":"2.2.6","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:13:09.686517Z","id":"CVE-2026-48543","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/krayin-crm-stored-template-injection-xss-via-web-form-description","source":"disclosure@vulncheck.com"},{"url":"https://github.com/aaronamran/CVE-Disclosures/tree/main/CVE-2026/CVE-2026-48541","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-77967","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:30.227","lastModified":"2026-09-25T17:17:14.407","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an authenticated session and access privileged device functionality."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:29:34.558371Z","id":"CVE-2026-77967","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-294"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-82164","sourceIdentifier":"security_alert@emc.com","published":"2026-09-24T20:17:32.103","lastModified":"2026-09-26T04:17:47.720","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Trusted Device Client,","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.1.359.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T00:00:00+00:00","id":"CVE-2026-82164","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000506918/dsa-2026-408-security-update-for-dell-trusted-device-client-for-an-incorrect-permission-assignment-for-critical-resource-vulnerability","source":"security_alert@emc.com"}]}},{"cve":{"id":"CVE-2026-82372","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T20:17:32.353","lastModified":"2026-10-01T21:17:25.900","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.0.1","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.0.1","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:25:24.827937Z","id":"CVE-2026-82372","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38997","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-82566","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:32.503","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially take advantage of this residual authentication state to access functionality associated with another client's session."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:36:51.806985Z","id":"CVE-2026-82566","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-84399","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:32.673","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated context. An unauthenticated attacker with adjacent network access could potentially use valid session state associated with another client to access privileged functionality."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:35:40.766701Z","id":"CVE-2026-84399","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-85496","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:32.890","lastModified":"2026-09-25T17:17:16.417","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session identifier and use it to bypass intended authorization controls."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:30:11.994628Z","id":"CVE-2026-85496","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-340"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-88761","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:33.643","lastModified":"2026-09-25T17:17:18.277","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are advertised by the product. An unauthenticated attacker within WiFi range could potentially determine the remaining password characters through limited guessing and gain unauthorized access to the device network."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:28:53.763452Z","id":"CVE-2026-88761","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-1391"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-88956","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:33.793","lastModified":"2026-09-25T17:17:18.660","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interface. The affected account does not require a password before granting access to a privileged system interface, and the interface also displays the device's WiFi password during startup. An unauthenticated attacker with physical access to the device could connect to the UART interface, obtain root privileges, and recover the WiFi password."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:33:35.486957Z","id":"CVE-2026-88956","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-93289","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:34.137","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Eufy","product":"Omni C20","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.4","versionType":"custom","status":"affected"}]},{"vendor":"Eufy","product":"Omni X10 Pro","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:36:22.263773Z","id":"CVE-2026-93289","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-93290","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:34.307","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapping data."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Eufy","product":"Omni C20","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:35:59.205461Z","id":"CVE-2026-93290","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-93291","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T20:17:34.463","lastModified":"2026-09-24T21:25:27.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to execute arbitrary code."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Eufy","product":"Omni C20","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.6.4","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","baseScore":9.4,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:33:25.114444Z","id":"CVE-2026-93291","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Primary","description":[{"lang":"en","value":"CWE-295"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-02","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-93354","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T20:17:34.613","lastModified":"2026-10-05T21:16:38.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary OAuth clients and take over user accounts by exploiting the OAuth 2.0 Dynamic Client Registration endpoint, which is enabled by default and requires no authentication. Attackers can send a POST request to the registration endpoint to obtain a client_id and client_secret, then craft a malicious authorization link pointing to an attacker-controlled redirect URI to capture authorization codes and exchange them for access tokens granting full API access to victim account data."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Gimanh","product":"taskview-community","defaultStatus":"unaffected","repo":"https://github.com/Gimanh/taskview-community","packageURL":"pkg:github/Gimanh/taskview-community","versions":[{"version":"0","lessThan":"1.56.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T19:42:33.450779Z","id":"CVE-2026-93354","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]}],"references":[{"url":"https://github.com/Gimanh/taskview-community/releases/tag/v1.56.0","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/taskview-community-missing-authentication-via-oauth-dynamic-client-registration","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96883","sourceIdentifier":"ff89ba41-3aa1-4d27-914a-91399e9639e5","published":"2026-09-24T20:17:35.240","lastModified":"2026-09-25T13:16:34.693","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions.\n\n\n\nTo remediate this issue, users should upgrade to version 2.1.2 or later."}],"affected":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","affectedData":[{"vendor":"AWS","product":"pgcollection","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThanOrEqual":"2.1.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T19:26:07.145601Z","id":"CVE-2026-96883","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","type":"Secondary","description":[{"lang":"en","value":"CWE-843"}]}],"references":[{"url":"https://aws.amazon.com/security/security-bulletins/2026-118-aws/","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/aws/pgcollection/releases/tag/v2.1.2","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"},{"url":"https://github.com/aws/pgcollection/security/advisories/GHSA-g539-cj32-hv6r","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}]}},{"cve":{"id":"CVE-2026-97324","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T20:17:35.553","lastModified":"2026-10-05T16:17:18.320","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback Handler. The manipulation of the argument ID leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["Demo-order Payment Callback Handler"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["Demo-order Payment Callback Handler"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-05T15:04:26.173686Z","id":"CVE-2026-97324","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-266"},{"lang":"en","value":"CWE-285"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97324","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908275","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409332","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409332/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97325","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T20:17:35.730","lastModified":"2026-09-25T15:17:57.510","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the component OAuth2 Client. The manipulation of the argument redirect_uri results in open redirect. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"YunaiV","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:yunaiv:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["OAuth2 Client"],"versions":[{"version":"2026.08","status":"affected"}]},{"vendor":"zhijiantianya","product":"ruoyi-vue-pro","cpes":["cpe:2.3:a:zhijiantianya:ruoyi-vue-pro:*:*:*:*:*:*:*:*"],"modules":["OAuth2 Client"],"versions":[{"version":"2026.08","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:03:39.880509Z","id":"CVE-2026-97325","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://vuldb.com/cve/CVE-2026-97325","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908276","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409333","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409333/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908276","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-97326","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T20:17:35.907","lastModified":"2026-09-25T18:17:34.380","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"songxinjianqwe","product":"Chat","cpes":["cpe:2.3:a:songxinjianqwe:chat:*:*:*:*:*:*:*:*"],"modules":["chat-server"],"versions":[{"version":"ac63d25297079eed5e4ba7e88d3b7a032637150d","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T17:02:57.611391Z","id":"CVE-2026-97326","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/HazyX0/cve/issues/1","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97326","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/908781","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409334","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409334/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97365","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T20:17:36.093","lastModified":"2026-09-29T04:18:02.903","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file crates/littrs/src/lib.rs. Executing a manipulation of the argument relative can lead to path traversal. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"chonkie-inc","product":"littrs","cpes":["cpe:2.3:a:chonkie-inc:littrs:*:*:*:*:*:*:*:*"],"versions":[{"version":"0.6.1","status":"affected"},{"version":"0.6.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T03:11:14.209798Z","id":"CVE-2026-97365","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/chonkie-inc/littrs/","source":"cna@vuldb.com"},{"url":"https://github.com/chonkie-inc/littrs/security/advisories/GHSA-j65r-rjxh-fgc4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97365","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/909328","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409349","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409349/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-14441","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T21:17:10.670","lastModified":"2026-10-01T21:17:19.540","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential identity mismatch conditions."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.1.0a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:56:52.119011Z","id":"CVE-2026-14441","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1025"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/39000","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-14442","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T21:17:11.920","lastModified":"2026-10-01T21:17:19.673","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and archive protection keys are logged without proper masking. A local or authenticated user with access to application logs or support bundles can view these cleartext credentials, potentially leading to unauthorized access to remote backup targets or protected archives."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"3.1.0a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T21:04:53.874700Z","id":"CVE-2026-14442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38999","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-14443","sourceIdentifier":"sirt@brocade.com","published":"2026-09-24T21:17:12.130","lastModified":"2026-10-01T21:17:19.800","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential compromise of encrypted network tunnels."}],"affected":[{"source":"sirt@brocade.com","affectedData":[{"vendor":"Brocade","product":"SANnav","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.0.1.a","versionType":"Brocade SANnav","status":"affected","changes":[{"at":"before 3.0.1.a","status":"unaffected"}]}]}]}],"metrics":{"cvssMetricV40":[{"source":"sirt@brocade.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:27:24.937174Z","id":"CVE-2026-14443","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"sirt@brocade.com","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38998","source":"sirt@brocade.com"}]}},{"cve":{"id":"CVE-2026-75558","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:36.203","lastModified":"2026-09-25T17:17:14.277","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password and gain unauthorized access to the device network."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:23:54.317735Z","id":"CVE-2026-75558","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-79959","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:44.353","lastModified":"2026-09-25T17:17:14.720","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physical access to the device could recover the credential and use it to obtain root access through the UART interface."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:19:50.495303Z","id":"CVE-2026-79959","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-81630","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:48.737","lastModified":"2026-09-25T17:17:15.007","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value supplied with the firmware instead of a trusted cryptographic signature. A suitably positioned attacker who intercepts a firmware download, or an authenticated attacker who submits a crafted update, could install modified firmware and execute unauthorized code on the device."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.2,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:22:58.800724Z","id":"CVE-2026-81630","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-82585","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:50.167","lastModified":"2026-09-25T17:17:15.133","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information exchanged between the device and its mobile application."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:18:25.762931Z","id":"CVE-2026-82585","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-319"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-82708","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:50.330","lastModified":"2026-09-25T17:17:15.267","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could submit a crafted request to access files within the device's removable storage that were not intended to be directly accessible through the web server. Exposed files could include recordings, images, diagnostic logs, or firmware files."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:21:06.946401Z","id":"CVE-2026-82708","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-82716","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:50.483","lastModified":"2026-09-25T17:17:15.393","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process. These logs remain accessible on removable storage after the support operation has completed. An unauthenticated attacker with physical access to the storage media could retrieve the logs and obtain sensitive device information."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.1,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:28:13.355260Z","id":"CVE-2026-82716","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-532"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-84403","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:55.220","lastModified":"2026-09-25T17:17:15.643","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device information, including device identifiers, firmware information, and protected WiFi credentials."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.5,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:24:46.709740Z","id":"CVE-2026-84403","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-87118","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:56.603","lastModified":"2026-09-25T17:17:16.550","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent network access could submit crafted command data that corrupts memory, potentially disrupting authentication state or causing the affected process to terminate and the device to restart, resulting in a temporary denial of service."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"Botslab","product":"G980H","defaultStatus":"unaffected","versions":[{"version":"30010_QHG980HN5294SysFW+","status":"affected"},{"version":"58_QHG980HMCN5291SysFW+","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.7,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.1,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:21:54.027592Z","id":"CVE-2026-87118","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.botslab.com/pages/about-botslab","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-267-01","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-88386","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T21:18:57.003","lastModified":"2026-09-25T17:17:17.833","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV file can cause the function to cast an unaligned destination address to unsigned int * and perform a 4-byte store. This results in undefined behavior leading to denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:48:59.681171Z","id":"CVE-2026-88386","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-122"}]}],"references":[{"url":"https://github.com/libsndfile/libsndfile/issues/1150","source":"cve@mitre.org"},{"url":"https://github.com/mhlavink/libsndfileci/commit/474e4d328b1e6240b93ec6ed14efb7c6a44bee57","source":"cve@mitre.org"},{"url":"https://github.com/libsndfile/libsndfile/issues/1150","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88387","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T21:18:57.120","lastModified":"2026-09-29T03:17:21.263","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can supply an attacker-controlled NewSubfileType value outside the range of a signed int. The parser converts this value and narrows it to int without performing range validation. This out-of-range conversion triggers undefined behavior, resulting in process termination and denial of service."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T02:38:06.086578Z","id":"CVE-2026-88387","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-681"}]}],"references":[{"url":"https://github.com/LibRaw/LibRaw/commit/b41cbbd61951783e0440590dae55411a16185bdf","source":"cve@mitre.org"},{"url":"https://github.com/LibRaw/LibRaw/issues/844","source":"cve@mitre.org"},{"url":"https://github.com/LibRaw/LibRaw/pull/853","source":"cve@mitre.org"},{"url":"https://github.com/LibRaw/LibRaw/issues/844","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-88388","sourceIdentifier":"cve@mitre.org","published":"2026-09-24T21:18:57.247","lastModified":"2026-09-25T16:17:29.213","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace handling path on 64-bit builds. A remote attacker can supply JavaScript input that triggers an exception and reaches jslPrintTokenLineMarker(), which passes the address of a 4-byte int column variable to jsvGetLineAndCol() as a size_t pointer. jsvGetLineAndCol() performs an 8-byte write through the mismatched pointer, overwriting adjacent stack memory."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:14:04.581717Z","id":"CVE-2026-88388","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/espruino/Espruino/commit/ecd7d43e084ba9aafa8245609347fe0f4383b38c","source":"cve@mitre.org"}]}},{"cve":{"id":"CVE-2026-93353","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-24T21:18:58.310","lastModified":"2026-09-30T21:17:17.490","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The _mkdir, _rmdir, and _chattr handlers construct destination paths using vfs.get(), vn.canonical(), and os.path.join() without invoking the chk_ap access check, enabling attackers to traverse symlinks leaving a volume's top directory and perform unauthorized file creation, deletion, or truncation via SSH_FXP_SETSTAT operations on paths outside any volume the account is authorized to access."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"9001","product":"copyparty","defaultStatus":"unknown","collectionURL":"https://pypi.org/project/copyparty/","repo":"https://github.com/9001/copyparty","packageURL":"pkg:github/9001/copyparty","versions":[{"version":"0","lessThanOrEqual":"1.20.24","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:50:59.870381Z","id":"CVE-2026-93353","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-59"},{"lang":"en","value":"CWE-424"}]}],"references":[{"url":"https://euriconicacio.github.io/blog/cve-2026-93353-a-volume-guard-enforced-one-call-site-at-a-time/","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/copyparty-sftp-volume-restriction-bypass-via-mkdir-rmdir-chattr-handlers","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-95699","sourceIdentifier":"ics-cert@hq.dhs.gov","published":"2026-09-24T21:18:58.613","lastModified":"2026-09-25T17:17:20.097","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and potential scalding due to unintended device activation."}],"affected":[{"source":"ics-cert@hq.dhs.gov","affectedData":[{"vendor":"MrSteam","product":"iSteamX application","defaultStatus":"unaffected","versions":[{"version":"v1.3.42 (build 44)","status":"affected"}]},{"vendor":"MrSteam","product":"iSteamX Hub","defaultStatus":"unaffected","versions":[{"version":"v4.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:16:01.270470Z","id":"CVE-2026-95699","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"ics-cert@hq.dhs.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-653"}]}],"references":[{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-267-01.json","source":"ics-cert@hq.dhs.gov"},{"url":"https://www.mrsteam.com/contactus/","source":"ics-cert@hq.dhs.gov"}]}},{"cve":{"id":"CVE-2026-97366","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T21:18:58.777","lastModified":"2026-09-25T16:17:30.567","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"jhen0409","product":"react-native-debugger","cpes":["cpe:2.3:a:jhen0409:react-native-debugger:*:*:*:*:*:*:*:*"],"modules":["Open in Editor Handler"],"versions":[{"version":"0.1","status":"affected"},{"version":"0.2","status":"affected"},{"version":"0.3","status":"affected"},{"version":"0.4","status":"affected"},{"version":"0.5","status":"affected"},{"version":"0.6","status":"affected"},{"version":"0.7","status":"affected"},{"version":"0.8","status":"affected"},{"version":"0.9","status":"affected"},{"version":"0.10","status":"affected"},{"version":"0.11","status":"affected"},{"version":"0.12","status":"affected"},{"version":"0.13","status":"affected"},{"version":"0.14.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T15:53:00.869447Z","id":"CVE-2026-97366","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"},{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://gist.github.com/Suuuuuzy/d25baf1973fd3c812277e02cde2243cc","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97366","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/909329","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409351","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409351/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-97368","sourceIdentifier":"cna@vuldb.com","published":"2026-09-24T21:18:58.953","lastModified":"2026-09-25T14:17:25.733","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of the argument userId causes authorization bypass. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. CVE-2026-56100 and CVE-2026-36765 are distinct issues. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"chillzhuang","product":"SpringBlade","cpes":["cpe:2.3:a:chillzhuang:springblade:*:*:*:*:*:*:*:*"],"modules":["user-auth-info Endpoint"],"versions":[{"version":"5.0.0","status":"affected"},{"version":"5.0.1","status":"affected"},{"version":"5.0.2","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T14:00:44.095762Z","id":"CVE-2026-97368","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-285"},{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://aibot88.github.io/CVERequest/SpringBlade/issue2.html","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-97368","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/909894","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409352","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/409352/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-85491","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-09-24T22:17:02.027","lastModified":"2026-09-25T17:17:16.240","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone.\n\nCatalyst::Seal replaces the dispatcher's prepare_action with a version that memoises how a path resolved: which dispatch type matched, at which level, and what was left over as arguments. The key is the request path and nothing else. Action roles that match on the method, content type, scheme or query make that resolution depend on state the key does not carry, so the memo answers for a request it was not built from.\n\nA path that resolves to no action is memoised as well, and replaying that entry returns without consulting any dispatch type, so no action is set and the request fails. A GET of a path whose action is declared POST-only therefore disables that path for every later request, the correct POST included. An entry that did resolve replays the level the earlier descent reached. Where a POST-only action sits below a shallower action on the same path, a GET memoises the shallow route, and a later POST is dispatched there with an auto() guarding the deeper controller never running.\n\nThe memo is cleared only when an action is registered, which happens at setup, so an entry lasts for the life of the process, and its cap of 2048 entries bounds how many paths one caller can disable. In the configuration measured, the misroute lands on the less privileged action, so it is an authorization check not running rather than a privilege gain."}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Catalyst-Seal","modules":["Catalyst::Seal"],"programFiles":["lib/Catalyst/Seal/Dispatch.pm"],"programRoutines":[{"name":"Catalyst::Seal::Dispatch::_prepare_action"}],"packageURL":"pkg:cpan/Catalyst-Seal","versions":[{"version":"0","lessThan":"0.03","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:34:58.812834Z","id":"CVE-2026-85491","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-706"},{"lang":"en","value":"CWE-1023"}]}],"references":[{"url":"https://metacpan.org/release/LNATION/Catalyst-Seal-0.02/source/lib/Catalyst/Seal/Dispatch.pm#L237-280","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://metacpan.org/release/LNATION/Catalyst-Seal-0.03/changes","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/8","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/9","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-87720","sourceIdentifier":"cve-coordination@google.com","published":"2026-09-24T22:17:02.170","lastModified":"2026-09-25T17:17:16.687","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheImpl) in Gerrit Code Review versions 2.16.0 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an authenticated user (or an unauthenticated user if the repository was previously public) to cause unauthorized disclosure of private repository content and durable restoration of revoked project-owner administrative privileges via crafted requests using repeated .git suffixes (such as project.git.git) across REST APIs, Gitiles, or SSH Git commands. Because Gerrit strips only a single terminal .git suffix when constructing the logical ProjectCache key while JGit (FileKey.lenient) resolves the suffixed alias to the same canonical bare repository on disk, revoking read access or removing owner rules on the canonical project name fails to evict the cached alias ProjectState during the cache validity window, enabling reads of newly created private commits or writes to refs/meta/config. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3."}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Gerrit","product":"Gerrit","defaultStatus":"unaffected","versions":[{"version":"2.16.0","lessThan":"3.12.10","versionType":"semver","status":"affected"},{"version":"3.13.0","lessThan":"3.13.9","versionType":"semver","status":"affected"},{"version":"3.14.0","lessThan":"3.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:51:27.457102Z","id":"CVE-2026-87720","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"},{"lang":"en","value":"CWE-706"},{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://issues.gerritcodereview.com/issues/538883789","source":"cve-coordination@google.com"},{"url":"https://issues.gerritcodereview.com/issues/538883789","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-87721","sourceIdentifier":"cve-coordination@google.com","published":"2026-09-24T22:17:02.327","lastModified":"2026-09-25T17:17:17.107","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a persistent denial of service (CPU exhaustion and HTTP worker thread pool starvation requiring a server restart) via crafted search queries containing deeply nested parentheses sent to query evaluation endpoints (/changes/?q=, /accounts/?q=, /groups/?query=, /projects/?query=, /Documentation/?q=, /changes/{id}/query?expression=, or SSH gerrit query). Because syntactic predicates in conditionOr and conditionAnd recurse via conditionBase without memoization prior to capability or visibility checks and worker threads do not abort when the client disconnects, a small number of requests (such as 25 requests matching default httpd.maxThreads) can permanently pin all HTTP worker threads. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3."}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Gerrit","product":"Gerrit","defaultStatus":"unaffected","versions":[{"version":"2.0.19","lessThan":"3.12.10","versionType":"semver","status":"affected"},{"version":"3.13.0","lessThan":"3.13.9","versionType":"semver","status":"affected"},{"version":"3.14.0","lessThan":"3.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:45:47.938400Z","id":"CVE-2026-87721","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-407"},{"lang":"en","value":"CWE-834"}]}],"references":[{"url":"https://issues.gerritcodereview.com/issues/541287630","source":"cve-coordination@google.com"}]}},{"cve":{"id":"CVE-2026-87722","sourceIdentifier":"cve-coordination@google.com","published":"2026-09-24T22:17:02.480","lastModified":"2026-09-25T17:17:17.360","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, RegexPathPredicate, and sibling predicates) and REST regex filter endpoints (RegexListSearcher /projects/?r= and RefFilter /projects/{project}/branches/?r=) in Gerrit Code Review versions 2.1.6 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker (or an authenticated user if anonymous read access is disabled) to cause a denial of service (CPU starvation and JVM heap exhaustion / OutOfMemoryError) via crafted search queries or REST API requests containing regular expressions with large counted repetitions or exponential DFA determinization patterns. Because the user-supplied regular expression is compiled into an unbounded dk.brics.automaton instance (new RegExp(re).toAutomaton()) on the request thread prior to index evaluation or access control visibility filtering, trivial queries can exhaust JVM heap or pin request threads regardless of heap size. This issue is fixed in Gerrit Code Review versions 3.12.10, 3.13.9, and 3.14.3."}],"affected":[{"source":"cve-coordination@google.com","affectedData":[{"vendor":"Gerrit","product":"Gerrit","defaultStatus":"unaffected","versions":[{"version":"2.1.6","lessThan":"3.12.10","versionType":"semver","status":"affected"},{"version":"3.13.0","lessThan":"3.13.9","versionType":"semver","status":"affected"},{"version":"3.14.0","lessThan":"3.14.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@google.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:40:30.387337Z","id":"CVE-2026-87722","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@google.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://issues.gerritcodereview.com/issues/540877705","source":"cve-coordination@google.com"}]}},{"cve":{"id":"CVE-2026-97636","sourceIdentifier":"security@apache.org","published":"2026-09-24T22:17:02.660","lastModified":"2026-09-25T17:17:21.137","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the backend to resolve a secret belonging to a different team, because after the team-scoped lookup misses the backend falls back to a team-agnostic path concatenated from the unvalidated key. The Execution API Variables route accepts a path-shaped key, so this is reachable from ordinary Dag code.\n\nAffects multi-team deployments using the HashiCorp Vault secrets backend. Single-team deployments are not affected, as there is no cross-team boundary to cross. This is the same class as CVE-2026-86465, CVE-2026-68870, CVE-2026-68871 and CVE-2026-68872 in the Akeyless, Azure Key Vault, Yandex Lockbox and Amazon secrets backends.\n\nUsers of apache-airflow-providers-hashicorp are recommended to upgrade to version 4.8.0 or later, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Airflow HashiCorp provider","defaultStatus":"unaffected","collectionURL":"https://pypi.python.org","packageName":"apache-airflow-providers-hashicorp","packageURL":"pkg:pypi/apache-airflow-providers-hashicorp","versions":[{"version":"4.6.0","lessThan":"4.8.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:37:39.918441Z","id":"CVE-2026-97636","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/apache/airflow/pull/70006","source":"security@apache.org"},{"url":"https://lists.apache.org/thread/l0fogo9dh5v07vnsxnhoh3c74othkr51","source":"security@apache.org"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68870","source":"security@apache.org"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68871","source":"security@apache.org"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68872","source":"security@apache.org"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86465","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-97230","sourceIdentifier":"9b29abf9-4ab0-4765-b253-1875cd9b441e","published":"2026-09-24T23:19:22.960","lastModified":"2026-09-25T17:17:20.880","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.\n\nThe generate_certificate runs a Python script saved as a certificate file.  The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.\n\nThe impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.\n\nThe releases have no test scripts nor build hooks.  The intention may have been to trigger the payload after installation.\n\nThe dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.\n\nThis is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.\n\nThe SHA-256 digests of the files are\n\n    ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0  IO-Socket-SSL-SelfCertificate-1.00.tar.gz\n    821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac  IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem\n\n    d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5  IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz"}],"affected":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","affectedData":[{"defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"IO-Socket-SSL-SelfCertificate","modules":["IO::Socket::SSL::SelfCertificate"],"programFiles":["lib/IO/Socket/SSL/SelfCertificate.pm","lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem"],"packageURL":"pkg:cpan/IO-Socket-SSL-SelfCertificate","versions":[{"version":"1.00","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-25T16:11:04.730543Z","id":"CVE-2026-97230","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"9b29abf9-4ab0-4765-b253-1875cd9b441e","type":"Secondary","description":[{"lang":"en","value":"CWE-506"}]}],"references":[{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95831","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"url":"https://www.nntp.perl.org/group/perl.cpan.testers.discuss/2026/09/msg4756.html","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}]}},{"cve":{"id":"CVE-2026-97387","sourceIdentifier":"security-advisories@github.com","published":"2026-09-24T23:19:23.077","lastModified":"2026-10-16T22:10:00.097","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This CVE is a duplicate of another CVE."}],"metrics":{},"references":[]}}]}