{"resultsPerPage":200,"startIndex":0,"totalResults":1753,"format":"NVD_CVE","version":"2.0","timestamp":"2026-10-25T05:09:13.267","vulnerabilities":[{"cve":{"id":"CVE-2026-92928","sourceIdentifier":"contact@securifera.com","published":"2026-09-23T00:16:59.773","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required to obtain an administrator takeover. The underlying design has been present since at least firmware 2.2.3.4.\n\nUpgrade to version 3.5.4."}],"affected":[{"source":"contact@securifera.com","affectedData":[{"vendor":"OpenEye","product":"Apex Network Video Recorder (NVR)","defaultStatus":"unknown","versions":[{"version":"3.2.9.376","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@securifera.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:59:32.425297Z","id":"CVE-2026-92928","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"contact@securifera.com","type":"Secondary","description":[{"lang":"en","value":"CWE-798"}]}],"references":[{"url":"https://portal.openeye.net/updates/issue-alerts/1058","source":"contact@securifera.com"},{"url":"https://www.securifera.com/advisories/","source":"contact@securifera.com"}]}},{"cve":{"id":"CVE-2026-92929","sourceIdentifier":"contact@securifera.com","published":"2026-09-23T00:17:00.897","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the affected non-TLS web interfaces and disclose configuration information. The underlying design has been present since at least firmware 2.2.3.4.\n\nUpgrade to version 3.5.4."}],"affected":[{"source":"contact@securifera.com","affectedData":[{"vendor":"OpenEye","product":"Apex Network Video Recorder (NVR)","defaultStatus":"unknown","versions":[{"version":"3.2.9.376","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@securifera.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:58:43.938282Z","id":"CVE-2026-92929","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"contact@securifera.com","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://portal.openeye.net/updates/issue-alerts/1059","source":"contact@securifera.com"},{"url":"https://www.securifera.com/advisories/","source":"contact@securifera.com"}]}},{"cve":{"id":"CVE-2026-92930","sourceIdentifier":"contact@securifera.com","published":"2026-09-23T00:17:01.080","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device secret or other server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and use it to reset the administrator password. The underlying design has been present since at least firmware 2.2.3.4.\n\nUpgrade to version 3.5.4."}],"affected":[{"source":"contact@securifera.com","affectedData":[{"vendor":"OpenEye","product":"Apex Network Video Recorder (NVR)","defaultStatus":"unknown","versions":[{"version":"3.2.9.376","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@securifera.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":6.2,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.3,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:40:55.835162Z","id":"CVE-2026-92930","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"contact@securifera.com","type":"Secondary","description":[{"lang":"en","value":"CWE-330"}]}],"references":[{"url":"https://portal.openeye.net/updates/issue-alerts/1060","source":"contact@securifera.com"},{"url":"https://www.securifera.com/advisories/","source":"contact@securifera.com"}]}},{"cve":{"id":"CVE-2026-94367","sourceIdentifier":"contact@securifera.com","published":"2026-09-23T00:17:01.200","lastModified":"2026-09-26T12:17:35.413","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4.\n\nThis vulnerability is resolved in OpenEye Apex version 3.4.3."}],"affected":[{"source":"contact@securifera.com","affectedData":[{"vendor":"OpenEye","product":"Apex Network Video Recorder (NVR)","defaultStatus":"unknown","versions":[{"version":"3.2.9.376","status":"affected"},{"version":"3.4.3","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@securifera.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:44:23.711465Z","id":"CVE-2026-94367","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"contact@securifera.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://portal.openeye.net/updates/issue-alerts/1061","source":"contact@securifera.com"},{"url":"https://www.securifera.com/advisories/","source":"contact@securifera.com"}]}},{"cve":{"id":"CVE-2026-95829","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T00:17:01.333","lastModified":"2026-09-26T01:17:03.067","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. This vulnerability affects the function PaginationInnerInterceptor.concatOrderBy of the file tduck-api/src/main/java/com/tduck/cloud/api/config/MybatisPlusConfig.java of the component Pagination Inner Interceptor. The manipulation of the argument orders[0].column leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is ea7f0fae7cb0fd998a3284c11addce689350cd69. It is suggested to install a patch to address this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"TDuckCloud","product":"tduck-platform","cpes":["cpe:2.3:a:tduckcloud:tduck-platform:*:*:*:*:*:*:*:*"],"modules":["Pagination Inner Interceptor"],"versions":[{"version":"5.0","status":"affected"},{"version":"5.1","status":"affected"},{"version":"5.2","status":"affected"},{"version":"5.3","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:13:37.993491Z","id":"CVE-2026-95829","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/TDuckCloud/tduck-survey-form/commit/ea7f0fae7cb0fd998a3284c11addce689350cd69","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95829","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/897248","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408522","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408522/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95830","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T00:17:01.537","lastModified":"2026-09-23T15:17:30.847","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in theRealSain Pixtream up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0. This issue affects some unknown processing of the file /post_upload.php. The manipulation of the argument media results in unrestricted upload. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"theRealSain","product":"Pixtream","cpes":["cpe:2.3:a:therealsain:pixtream:*:*:*:*:*:*:*:*"],"versions":[{"version":"866afd4f0cea812b918780fb74b67dccf8c4d6a0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:56:56.510566Z","id":"CVE-2026-95830","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-284"},{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://github.com/yingxiujie/cve/issues/11","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95830","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/897169","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408523","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408523/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95833","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T00:17:01.743","lastModified":"2026-09-23T15:17:30.993","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"itsourcecode","product":"Leave Management System","cpes":["cpe:2.3:a:itsourcecode:leave_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:30:39.161439Z","id":"CVE-2026-95833","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/ltranquility/submit_repository/issues/16","source":"cna@vuldb.com"},{"url":"https://itsourcecode.com/","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95833","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953126","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408524","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408524/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95868","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T00:17:01.937","lastModified":"2026-09-23T17:17:22.097","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is the function mysqli_query of the file admin/display_menu.php of the component Search Form. This manipulation of the argument s1 causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"AdithyaYelloju","product":"Restaurant-Management-System","cpes":["cpe:2.3:a:adithyayelloju:restaurant-management-system:*:*:*:*:*:*:*:*"],"modules":["Search Form"],"versions":[{"version":"7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:22:04.514448Z","id":"CVE-2026-95868","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/","source":"cna@vuldb.com"},{"url":"https://github.com/AdithyaYelloju/Restaurant-Management-System/issues/4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95868","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953178","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408542","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408542/cti","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953178","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95897","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T01:16:31.920","lastModified":"2026-09-23T15:17:31.147","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Dask up to 2026.8.0. This affects the function from_npy_stack of the file dask/array/core.py of the component Loader. Such manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"n/a","product":"Dask","cpes":["cpe:2.3:a:dask:dask:*:*:*:*:*:*:*:*"],"modules":["Loader"],"versions":[{"version":"2026.0","status":"affected"},{"version":"2026.1","status":"affected"},{"version":"2026.2","status":"affected"},{"version":"2026.3","status":"affected"},{"version":"2026.4","status":"affected"},{"version":"2026.5","status":"affected"},{"version":"2026.6","status":"affected"},{"version":"2026.7","status":"affected"},{"version":"2026.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:01:12.785179Z","id":"CVE-2026-95897","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/dask/dask/","source":"cna@vuldb.com"},{"url":"https://github.com/dask/dask/issues/12578","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95897","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953281","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408543","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408543/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95924","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T01:16:32.110","lastModified":"2026-09-26T01:17:03.220","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:16:21.704117Z","id":"CVE-2026-95924","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/huliangjia/cve/issues/4","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95924","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953303","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408546","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408546/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95925","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T01:16:32.293","lastModified":"2026-09-23T15:17:31.293","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=update. The manipulation of the argument difficulty_id results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:56:24.862926Z","id":"CVE-2026-95925","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/huliangjia/cve/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95925","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953304","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408547","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408547/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96271","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T01:16:32.477","lastModified":"2026-09-24T21:08:55.030","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share tokens for victim albums, exposing photos and sub-albums to anyone with the link while retaining indefinite control over token settings."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"photoview","product":"photoview","defaultStatus":"unaffected","repo":"https://github.com/photoview/photoview","packageURL":"pkg:github/photoview/photoview","versions":[{"version":"0","lessThanOrEqual":"2.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:14:53.755232Z","id":"CVE-2026-96271","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/photoview/photoview","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/blob/81affea602401c2f0207d955919ddcc0670a9222/api/graphql/models/actions/share_token_actions.go#L64-L82","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/commit/20541762fe6d9e0ce363c3d4c55556e4ccdc57a2","source":"disclosure@vulncheck.com"},{"url":"https://github.com/photoview/photoview/issues/1494","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/photoview-through-2.4.0-authorization-bypass-via-sharealbum","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-96272","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T01:16:32.633","lastModified":"2026-09-26T01:17:03.667","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials, email addresses, and administrator password hashes for account takeover."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"MacWarrior","product":"clipbucket-v5","defaultStatus":"unaffected","repo":"https://github.com/MacWarrior/clipbucket-v5","packageURL":"pkg:github/MacWarrior/clipbucket-v5","versions":[{"version":"0","lessThan":"5.5.3-#182","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:15:09.512418Z","id":"CVE-2026-96272","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/MacWarrior/clipbucket-v5","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/blob/57b0235f2eae390f4946c042bf81c182a9f82782/upload/includes/classes/photos.class.php#L408-L413","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/commit/7fd0af6f8b5826c2d6ef0976dbb1867f5c36b707","source":"disclosure@vulncheck.com"},{"url":"https://github.com/MacWarrior/clipbucket-v5/pull/874","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/sqli-photo-seach-clipbucketv5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/clipbucket-v5-before-5.5.3-182-sql-injection-via-search-result-php","source":"disclosure@vulncheck.com"},{"url":"https://hackmd.io/@leediay/sqli-photo-seach-clipbucketv5","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-96273","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T01:16:32.790","lastModified":"2026-09-28T17:17:53.210","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB.createUnregisteredOption(), causing an ArrayIndexOutOfBoundsException that leaves domain objects permanently locked. Attackers can craft a malicious program database file that, when imported, causes the application to stall and prevents resource cleanup or graceful shutdown."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"NationalSecurityAgency","product":"ghidra","defaultStatus":"unaffected","repo":"https://github.com/NationalSecurityAgency/ghidra","packageURL":"pkg:github/NationalSecurityAgency/ghidra","versions":[{"version":"0","lessThan":"12.1.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:46:33.318445Z","id":"CVE-2026-96273","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-460"},{"lang":"en","value":"CWE-667"}]}],"references":[{"url":"https://github.com/NationalSecurityAgency/ghidra","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_12.1.3_build/Ghidra/Framework/Project/src/main/java/ghidra/framework/data/OptionsDB.java#L358-L366","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/commit/594da048431aab082a9da7c4a965874d07d33310","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/releases/tag/Ghidra_12.1.4_build","source":"disclosure@vulncheck.com"},{"url":"https://github.com/NationalSecurityAgency/ghidra/security/advisories/GHSA-4w7g-wmg8-fgv5","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ghidra-before-12.1.4-denial-of-service-via-crafted-database","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-95926","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T02:16:54.527","lastModified":"2026-09-23T15:17:31.440","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update. This manipulation of the argument test_id causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:30:27.302568Z","id":"CVE-2026-95926","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/huliangjia/cve/issues/7","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95926","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953308","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408548","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408548/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95927","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T02:16:55.537","lastModified":"2026-09-23T18:17:11.757","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer_0/admins/assessments/pretest/exam-delete.php. Such manipulation of the argument test_id leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Online Reviewer Management System","cpes":["cpe:2.3:a:sourcecodester:online_reviewer_management_system:*:*:*:*:*:*:*:*"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:47:44.169970Z","id":"CVE-2026-95927","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/huliangjia/cve/issues/8","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95927","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953309","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408549","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408549/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95928","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T02:16:55.717","lastModified":"2026-09-23T14:57:49.540","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in recommenders-team recommenders up to 1.2.1. This impacts the function pickle.load of the file recommenders/models/newsrec/io/mind_iterator.py of the component Dict Loading. Performing a manipulation results in deserialization. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"recommenders-team","product":"recommenders","cpes":["cpe:2.3:a:recommenders-team:recommenders:*:*:*:*:*:*:*:*"],"modules":["Dict Loading"],"versions":[{"version":"1.2.0","status":"affected"},{"version":"1.2.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.0,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:50:57.392964Z","id":"CVE-2026-95928","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/recommenders-team/recommenders/","source":"cna@vuldb.com"},{"url":"https://github.com/recommenders-team/recommenders/issues/2368","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95928","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953327","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408550","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408550/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-89425","sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","published":"2026-09-23T03:17:04.357","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound. Unlike the three sibling parser implementations, including UTF8StreamJsonParser, it never consults ErrorReportConfiguration.getMaxErrorTokenLength() (default 256). A malformed token supplied to a parser created through JsonFactory.createParser(DataInput) is therefore accumulated in full. No StreamReadConstraints setting mitigates this: maxDocumentLength cannot be applied to DataInput sources at all, and maxStringLength does not cover this path because the accumulation bypasses ReadConstrainedTextBuffer. The reporter measured a 20,000,109-character exception message from a 20-million-character malformed token on the DataInput path, against 367 characters for identical input on the InputStream path. Scaling the payload drives the StringBuilder, which also incurs byte-to-char expansion and internal array doubling, to many times the raw payload size and can trigger OutOfMemoryError for the whole JVM. UTF8DataInputJsonParser was introduced in 2.8.0 together with createParser(DataInput); releases before 2.8.0 do not contain the affected class."}],"affected":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","affectedData":[{"vendor":"FasterXML","product":"jackson-core","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"com.fasterxml.jackson.core:jackson-core","programRoutines":[{"name":"com.fasterxml.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}],"repo":"https://github.com/FasterXML/jackson-core","versions":[{"version":"2.8.0","lessThanOrEqual":"2.18.10","versionType":"maven","status":"affected"},{"version":"2.19.0","lessThanOrEqual":"2.21.6","versionType":"maven","status":"affected"},{"version":"2.22.0","lessThanOrEqual":"2.22.2","versionType":"maven","status":"affected"}]},{"vendor":"FasterXML","product":"jackson-core","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"tools.jackson.core:jackson-core","programRoutines":[{"name":"tools.jackson.core.json.UTF8DataInputJsonParser._reportInvalidToken"}],"repo":"https://github.com/FasterXML/jackson-core","versions":[{"version":"3.0.0","lessThanOrEqual":"3.1.6","versionType":"maven","status":"affected"},{"version":"3.2.0","lessThanOrEqual":"3.2.2","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:54:51.050132Z","id":"CVE-2026-89425","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://github.com/FasterXML/jackson-core/pull/1698","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-7hhh-6rmp-j9qf","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91776","sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","published":"2026-09-23T03:17:04.620","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."}],"affected":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","affectedData":[{"vendor":"FasterXML","product":"jackson-databind","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"com.fasterxml.jackson.core:jackson-databind","programRoutines":[{"name":"com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer"}],"repo":"https://github.com/FasterXML/jackson-databind","versions":[{"version":"2.0.0","lessThanOrEqual":"2.18.10","versionType":"maven","status":"affected"},{"version":"2.19.0","lessThanOrEqual":"2.21.6","versionType":"maven","status":"affected"},{"version":"2.22.0","lessThanOrEqual":"2.22.2","versionType":"maven","status":"affected"}]},{"vendor":"FasterXML","product":"jackson-databind","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"tools.jackson.core:jackson-databind","programRoutines":[{"name":"tools.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer"}],"repo":"https://github.com/FasterXML/jackson-databind","versions":[{"version":"3.0.0","lessThanOrEqual":"3.1.6","versionType":"maven","status":"affected"},{"version":"3.2.0","lessThanOrEqual":"3.2.2","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:02:42.582789Z","id":"CVE-2026-91776","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/issues/6203","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-91777","sourceIdentifier":"36c7be3b-2937-45df-85ea-ca7133ea542c","published":"2026-09-23T03:17:04.783","lastModified":"2026-09-24T20:43:32.537","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure."}],"affected":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","affectedData":[{"vendor":"FasterXML","product":"jackson-databind","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"com.fasterxml.jackson.core:jackson-databind","programRoutines":[{"name":"com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference"},{"name":"com.fasterxml.jackson.databind.deser.std.MapDeserializer.MapReferringAccumulator.resolveForwardReference"}],"repo":"https://github.com/FasterXML/jackson-databind","versions":[{"version":"2.5.0","lessThanOrEqual":"2.18.10","versionType":"maven","status":"affected"},{"version":"2.19.0","lessThanOrEqual":"2.21.6","versionType":"maven","status":"affected"},{"version":"2.22.0","lessThanOrEqual":"2.22.2","versionType":"maven","status":"affected"}]},{"vendor":"FasterXML","product":"jackson-databind","defaultStatus":"unaffected","collectionURL":"https://repo1.maven.org/maven2","packageName":"tools.jackson.core:jackson-databind","programRoutines":[{"name":"tools.jackson.databind.deser.jdk.CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference"},{"name":"tools.jackson.databind.deser.jdk.MapDeserializer.MapReferringAccumulator.resolveForwardReference"}],"repo":"https://github.com/FasterXML/jackson-databind","versions":[{"version":"3.0.0","lessThanOrEqual":"3.1.6","versionType":"maven","status":"affected"},{"version":"3.2.0","lessThanOrEqual":"3.2.2","versionType":"maven","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:04:51.226591Z","id":"CVE-2026-91777","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"36c7be3b-2937-45df-85ea-ca7133ea542c","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/issues/6204","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","source":"36c7be3b-2937-45df-85ea-ca7133ea542c"},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95929","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:05.263","lastModified":"2026-09-26T01:17:03.367","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A weakness has been identified in iFlytek astron-agent up to 1.0.7. Affected is an unknown function of the file console/backend/commons/src/main/resources/mapper/ChatBotMarketMapper.xml of the component getBotList API endpoint. Executing a manipulation of the argument sortDirection can lead to sql injection. It is possible to launch the attack remotely. Upgrading to version reward-1575 is able to address this issue. This patch is called 6702be70ae802b1048f5fbec91e690e7b71a4165. You should upgrade the affected component."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"iFlytek","product":"astron-agent","cpes":["cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:*"],"modules":["getBotList API endpoint"],"versions":[{"version":"1.0.0","status":"affected"},{"version":"1.0.1","status":"affected"},{"version":"1.0.2","status":"affected"},{"version":"1.0.3","status":"affected"},{"version":"1.0.4","status":"affected"},{"version":"1.0.5","status":"affected"},{"version":"1.0.6","status":"affected"},{"version":"1.0.7","status":"affected"},{"version":"reward-1575","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:18:17.471709Z","id":"CVE-2026-95929","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://github.com/iflytek/astron-agent/","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/commit/6702be70ae802b1048f5fbec91e690e7b71a4165","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/issues/1329","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/pull/1342","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/releases/tag/reward-1575","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95929","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953330","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408551","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408551/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95930","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:05.483","lastModified":"2026-09-23T15:17:31.587","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in iFlytek astron-agent up to 1.0.6. Affected by this vulnerability is the function UrlCheckTool.checkUrl of the component debugToolV2 API endpoint. The manipulation of the argument endPoint leads to server-side request forgery. The attack can be initiated remotely. Upgrading to version reward-1575 addresses this issue. The identifier of the patch is 45ee5fb647e9894e73b0d7720fa94a66e4540bbb. The affected component should be upgraded."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"iFlytek","product":"astron-agent","cpes":["cpe:2.3:a:iflytek:astron-agent:*:*:*:*:*:*:*:*"],"modules":["debugToolV2 API endpoint"],"versions":[{"version":"1.0.0","status":"affected"},{"version":"1.0.1","status":"affected"},{"version":"1.0.2","status":"affected"},{"version":"1.0.3","status":"affected"},{"version":"1.0.4","status":"affected"},{"version":"1.0.5","status":"affected"},{"version":"1.0.6","status":"affected"},{"version":"reward-1575","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":3.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:53:43.906117Z","id":"CVE-2026-95930","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://github.com/iflytek/astron-agent/","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/commit/45ee5fb647e9894e73b0d7720fa94a66e4540bbb","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/issues/1323","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/pull/1338","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/releases/tag/reward-1575","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95930","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953331","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408552","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408552/cti","source":"cna@vuldb.com"},{"url":"https://github.com/iflytek/astron-agent/issues/1323","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-95957","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:05.680","lastModified":"2026-09-23T15:17:31.773","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file student_signup.php of the component Self-Registration. Performing a manipulation of the argument full_name results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"SourceCodester","product":"Smart Attendance System with QR Code Scanner","cpes":["cpe:2.3:a:sourcecodester:smart_attendance_system_with_qr_code_scanner:*:*:*:*:*:*:*:*"],"modules":["Self-Registration"],"versions":[{"version":"1.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:30:15.111107Z","id":"CVE-2026-95957","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/Jack-MRJ/Smart-Attendance-System-with-QR-Code-Scanner","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95957","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953379","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408556","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408556/cti","source":"cna@vuldb.com"},{"url":"https://www.sourcecodester.com/","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-95958","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:05.883","lastModified":"2026-09-23T18:17:11.913","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of the file manape/pe.cpp of the component PE Parser. Performing a manipulation of the argument BlockSize results in integer underflow. The attack requires a local approach. The patch is named c372b6bbca9d8c63812be50596fefa4a79c65fd0. It is recommended to apply a patch to fix this issue."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"JusticeRage","product":"Manalyze","cpes":["cpe:2.3:a:justicerage:manalyze:*:*:*:*:*:*:*:*"],"modules":["PE Parser"],"versions":[{"version":"1.0.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","baseScore":3.3,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":1.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:S/C:N/I:N/A:P","baseScore":1.7,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL"},"baseSeverity":"LOW","exploitabilityScore":3.1,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T17:49:14.873674Z","id":"CVE-2026-95958","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-189"},{"lang":"en","value":"CWE-191"}]}],"references":[{"url":"https://github.com/JusticeRage/Manalyze/","source":"cna@vuldb.com"},{"url":"https://github.com/JusticeRage/Manalyze/commit/c372b6bbca9d8c63812be50596fefa4a79c65fd0","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-95958","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/953395","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408568","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408568/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96257","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T03:17:06.077","lastModified":"2026-09-23T15:17:31.920","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw has been found in Fast FAC1203R Gigabit Edition 2.0.4. Affected by this issue is the function copy_msg_element of the component Device Discovery Service. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"Fast","product":"FAC1203R Gigabit Edition","cpes":["cpe:2.3:a:fast:fac1203r_gigabit_edition:*:*:*:*:*:*:*:*"],"modules":["Device Discovery Service"],"versions":[{"version":"2.0.4","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:C/I:C/A:C","baseScore":10.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":10.0,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:06:54.550015Z","id":"CVE-2026-96257","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-119"},{"lang":"en","value":"CWE-121"}]}],"references":[{"url":"https://github.com/xiaobor123/vuls-find-VxWorks/tree/main/vul-find-FAST_FAC1203R-copy_msg_element","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96257","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/901889","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408707","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408707/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2026-96258","sourceIdentifier":"cna@vuldb.com","published":"2026-09-23T04:17:58.613","lastModified":"2026-09-26T01:17:03.527","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"affected":[{"source":"cna@vuldb.com","affectedData":[{"vendor":"onSite internet GmbH","product":"Auktion NG Auktionssoftware","cpes":["cpe:2.3:a:onsite_internet_gmbh:auktion_ng_auktionssoftware:*:*:*:*:*:*:*:*"],"modules":["Public Password Reset Endpoint"],"versions":[{"version":"20260722","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"PROOF_OF_CONCEPT","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"cvssMetricV2":[{"source":"cna@vuldb.com","type":"Secondary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5.0,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T00:19:04.859425Z","id":"CVE-2026-96258","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cna@vuldb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://github.com/CSDVi/cve/issues/5","source":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-96258","source":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/901875","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408708","source":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/408708/cti","source":"cna@vuldb.com"}]}},{"cve":{"id":"CVE-2022-4997","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:16:59.060","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"jet-form-builder-stripe-gateway","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:44:01.446471Z","id":"CVE-2022-4997","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/368c38af-66c3-4500-ad50-87ada3abecd1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2025-15696","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:00.710","lastModified":"2026-10-14T19:10:00.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Real3D Flipbook  WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators."},{"lang":"es","value":"El plugin de WordPress Real3D Flipbook anterior a la versión 5.4 no sanea ni escapa varios campos del editor de flipbooks antes de renderizarlos de nuevo en el editor de administración, lo que permite a usuarios con el rol de Autor o superior inyectar scripts web arbitrarios que se ejecutan en el navegador de cualquier usuario que posteriormente abra el flipbook afectado para editarlo, incluidos los administradores."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Real3D Flipbook","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:44:16.188877Z","id":"CVE-2025-15696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7b454d8e-e2cd-4990-a72d-339b8065d359/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-14321","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:00.850","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"divi-dash","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.0.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:45:15.568605Z","id":"CVE-2026-14321","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6f56b800-c8f6-4cd9-a137-c05b718db201/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-16264","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:00.963","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Newsletters","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.18.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:45:35.602362Z","id":"CVE-2026-16264","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0dd1de2d-e9bb-4c42-a78b-2643d43dfed6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-18364","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.073","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"zportals","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:45:45.654396Z","id":"CVE-2026-18364","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f1b6d694-e55a-42a8-8308-48ec158b26a5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-18365","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.193","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a subscriber-level account to disclose the display name and email address of every registered user, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"zportals","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.4.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:45:54.508030Z","id":"CVE-2026-18365","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/752e218f-bd97-40d4-b32b-9e913b520db6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-19438","sourceIdentifier":"cybersecurity@ch.abb.com","published":"2026-09-23T06:17:01.310","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I.\n\nThis issue affects Mint Workbench I: through 5876."}],"affected":[{"source":"cybersecurity@ch.abb.com","affectedData":[{"vendor":"ABB","product":"Mint Workbench I","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"5876","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cybersecurity@ch.abb.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"cybersecurity@ch.abb.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:09:43.306887Z","id":"CVE-2026-19438","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cybersecurity@ch.abb.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"references":[{"url":"https://search.abb.com/library/Download.aspx?DocumentID=9AKK108473A3188&LanguageCode=en&DocumentPartId=&Action=Launch","source":"cybersecurity@ch.abb.com"}]}},{"cve":{"id":"CVE-2026-75799","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.710","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"YAHMAN Add-ons","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"0.9.31","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:05.241025Z","id":"CVE-2026-75799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b12397e7-5d9b-42bf-bd31-5d3401bc4600/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-77765","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.827","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Better Payment  WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Better Payment","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.3.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:19.942088Z","id":"CVE-2026-77765","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/932f8c74-1ded-40ee-b1fd-a328f3626f21/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-77766","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:01.933","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records.\n\nVersions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"8.5","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:31.280420Z","id":"CVE-2026-77766","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1b8acd9b-8309-4453-a7f7-61a463fe9ae1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-80342","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.040","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Payment Plugins for PayPal WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.0.27","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:40.282472Z","id":"CVE-2026-80342","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/5c3eea0d-7f7f-48e5-8f78-c553b3fdeabf/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-81338","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.150","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:48.963456Z","id":"CVE-2026-81338","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://wpscan.com/vulnerability/e8494c71-fb0f-4ab9-a8b7-8db3745a2d9b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-81339","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.263","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MasterStudy LMS WordPress Plugin  WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/fail status and attempt timestamps by referencing an attempt identifier belonging to another user."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MasterStudy LMS WordPress Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.7.50","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:46:57.286810Z","id":"CVE-2026-81339","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f027d0b1-5d8a-4e80-adb3-bbf97dc53306/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-82843","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.363","lastModified":"2026-09-24T14:43:01.483","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP OAuth Server ( Login with WordPress )","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.4.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","baseScore":9.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.3,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:47:10.118793Z","id":"CVE-2026-82843","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/45bc7096-5d04-4fe6-a332-31aed507a3a0/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-83555","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.483","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Email Subscribers & Newsletters  WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscription status, allowing unauthenticated users to force-unsubscribe or force-confirm an arbitrary subscriber whose email address they know."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Email Subscribers & Newsletters","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.9.35","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:47:18.250423Z","id":"CVE-2026-83555","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/54cb2a98-7860-40dd-817e-1294317084aa/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84026","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.667","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not restrict access to a REST endpoint that returns user records, allowing unauthenticated attackers to read registered users' private contact details."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"8.1","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:47:30.419547Z","id":"CVE-2026-84026","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4311f66d-f032-4753-88e8-2afbd5d73ebc/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84027","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.840","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders through its REST API, allowing users with the subscriber role and above to create paid order and payment records with arbitrary amounts and attribute them to other users."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"8.9.1","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:29.813763Z","id":"CVE-2026-84027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/dff1eca0-3fdd-4e7f-8ad2-1fa52b3b4a80/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84046","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:02.967","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not validate a user-supplied URL before fetching it server-side, allowing users with the subscriber role and above to make the server issue requests to internal addresses."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":5.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:21.637445Z","id":"CVE-2026-84046","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a5279c4b-ce91-4322-b5c3-70cd1d6d3ba8/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84098","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.070","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not properly verify a listing's ownership before deleting it, allowing authenticated attackers with Subscriber-level access and above to delete arbitrary listings, including ones belonging to other users.\n\nThis is an incomplete fix of CVE-2023-1889 / CVE-2023-35052: a separate, unaddressed listing-deletion path allows the same impact, from at least version 3.1.0 through the current release."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"3.1.0","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:13.034357Z","id":"CVE-2026-84098","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b5f83718-84ff-49e4-9ad7-395cc0ab494b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84150","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.173","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any authenticated user with subscriber-level access to view and alter another user's favorites."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Directorist: AI-Powered Business Directory, Listings & Classified Ads","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"8.9.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:00.544687Z","id":"CVE-2026-84150","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c8e6b49b-874f-41d6-bff4-58e9fe559463/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84168","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.280","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Easy Hide Login","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.7","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:50.889102Z","id":"CVE-2026-84168","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/be4e40a1-8f2e-4c80-8615-77cc325c90b6/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84741","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.383","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"The Events Calendar","defaultStatus":"unaffected","versions":[{"version":"4.5","lessThan":"6.17.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:40.662380Z","id":"CVE-2026-84741","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/0f34a90e-3d8b-4a87-a2ed-fe4d2c481732/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84742","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.497","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"The Events Calendar","defaultStatus":"unaffected","versions":[{"version":"6.15.0","lessThan":"6.17.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:20.442604Z","id":"CVE-2026-84742","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f9228a51-1293-4a96-95da-0e57b7eb5f6b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-84743","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.603","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"The Events Calendar","defaultStatus":"unaffected","versions":[{"version":"6.15.16.1","lessThan":"6.17.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","baseScore":3.8,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:10.909564Z","id":"CVE-2026-84743","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6c20337d-f485-491c-a380-38a3039af17d/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-85006","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.703","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The HappyAddons for Elementor  WordPress plugin before 3.50.0 does not escape an icon value on one of its button widgets before outputting it inside an HTML attribute, allowing users with Contributor-level access and above to inject event-handler attributes that execute JavaScript in the browser of anyone who views the page, including higher-privileged users reviewing the content, even though such users do not hold the unfiltered_html capability."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"HappyAddons for Elementor","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.50.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:42:01.226496Z","id":"CVE-2026-85006","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/50319e24-8ae8-40b8-9106-ed881359700e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86602","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.820","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Recipe Maker","defaultStatus":"unaffected","versions":[{"version":"10.3.0","lessThan":"10.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:41:51.276091Z","id":"CVE-2026-86602","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/46324e95-20dc-465e-90ab-14bcbf136166/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86603","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:03.930","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Recipe Maker","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"10.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:41:34.015772Z","id":"CVE-2026-86603","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f5eedd48-91a6-4216-9e96-32dfb7a23ee4/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86608","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.030","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Recipe Maker","defaultStatus":"unaffected","versions":[{"version":"9.8.0","lessThan":"10.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:41:21.072442Z","id":"CVE-2026-86608","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d7f0f9dd-4180-4210-9c48-dae67e8f5d8e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86783","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.130","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Post Grid Gutenberg Blocks  WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route that returns the custom field keys of a given post, allowing unauthenticated users to disclose the custom field key names of arbitrary posts, including private, draft, pending, scheduled and password-protected posts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Post Grid Gutenberg Blocks","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.0.41","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:39:47.271809Z","id":"CVE-2026-86783","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/719fc130-748b-4bad-8091-2858664299ed/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86785","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.233","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Social Commerce for WooCommerce","defaultStatus":"unknown","versions":[{"version":"0","lessThanOrEqual":"2.5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:43:41.027335Z","id":"CVE-2026-86785","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9a4c36bd-c7f7-4068-ac73-b29ee66def96/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86842","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.343","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Real3D Flipbook  WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Real3D Flipbook","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:39:32.693971Z","id":"CVE-2026-86842","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b98713d1-e618-4728-baea-f26015e24b60/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87069","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.450","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms  WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Forminator Forms","defaultStatus":"unaffected","versions":[{"version":"1.38.1","lessThan":"1.57.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:39:22.942277Z","id":"CVE-2026-87069","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/cf14469d-eb14-4ab0-acdd-318a6c9d5d92/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87074","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.557","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms  WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms  WordPress plugin before 1.57.2.1 itself and can be replayed without limit."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Forminator Forms","defaultStatus":"unaffected","versions":[{"version":"1.17.1","lessThan":"1.57.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:39:07.818340Z","id":"CVE-2026-87074","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/74ca7b28-25b7-4d68-ad4b-4785b1d2c666/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87979","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.657","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unauthenticated attackers to write a card-token record to any user's account and to enumerate registered accounts."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paymob for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.1.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:55.060045Z","id":"CVE-2026-87979","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/550a465c-4856-45bb-b609-0eaf1f2be660/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87981","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.760","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paymob for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.1.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":1.2,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:44.511250Z","id":"CVE-2026-87981","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/91c2d07f-0489-4b47-ac04-bc892d9fee5a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88929","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.860","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Product Badge, Label, Countdown Timer for WooCommerce  WordPress plugin before 7.5.2 does not check whether a product is published before returning its details to unauthenticated users, allowing them to read the title, description and price of draft, pending and private products."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Product Badge, Label, Countdown Timer for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"7.0.0","lessThan":"7.5.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:34.066366Z","id":"CVE-2026-88929","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d6e10041-4171-4153-94bc-e8936be779c1/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-88997","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:04.967","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"JSM Show Post Metadata","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.9.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:22.858441Z","id":"CVE-2026-88997","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/1699d3aa-29ca-4197-8e3b-0b03ecce751a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-89331","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.083","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The FluentBoards  WordPress plugin before 2.1.0 does not properly restrict the member data returned by its public, token-shared board feature, allowing unauthenticated users to disclose the email addresses of a shared board's members, typically including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"FluentBoards","defaultStatus":"unaffected","versions":[{"version":"1.95","lessThan":"2.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:38:09.770375Z","id":"CVE-2026-89331","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/d1aaacdf-7427-411f-b376-999793524a4b/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-90951","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.210","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paid Membership Subscriptions  WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paid Membership Subscriptions","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:37:55.526356Z","id":"CVE-2026-90951","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://wpscan.com/vulnerability/bf740af6-3674-461e-83f0-22bd5c5b3378/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-90985","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.317","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WPC Smart Compare for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.6.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:37:45.793276Z","id":"CVE-2026-90985","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/ff8a599b-e74f-485e-baf8-8d162633b2ea/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91024","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.417","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Booking Manager  WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Booking Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:37:23.430430Z","id":"CVE-2026-91024","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a5472152-0b96-4fc6-af90-2f1b01811237/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91025","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.523","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Booking Manager  WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager  WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or overwrite the Booking Manager  WordPress plugin before 2.1.21's per-user settings on arbitrary users, including administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Booking Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.1.21","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:37:12.873081Z","id":"CVE-2026-91025","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://wpscan.com/vulnerability/6e010e3e-78e8-4bfc-b880-d9a85cff2c2a/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91073","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.630","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Subscribe Forms  WordPress plugin before 1.6.3 does not sanitise and escape one of its form settings before outputting it in a page, allowing authenticated users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who views a page embedding the form, including logged-out visitors and administrators."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Subscribe Forms","defaultStatus":"unaffected","versions":[{"version":"1.4.1","lessThan":"1.6.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:59.017689Z","id":"CVE-2026-91073","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://wpscan.com/vulnerability/50d0d5b6-2204-4af3-92d5-75085ce2f176/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-91077","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.737","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Event Booking Manager for WooCommerce  WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Event Booking Manager for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"5.3.6","lessThan":"5.7.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:48.669150Z","id":"CVE-2026-91077","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-284"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9db8d1c4-2bf8-4259-b95f-b131fc385a2e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93507","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.843","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read access to the resulting copy."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WC Fields Factory","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.1.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","baseScore":3.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:38.282362Z","id":"CVE-2026-93507","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/21569537-3a83-4df1-a6c2-8ca720e71586/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93508","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:05.950","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless of ownership, and to manipulate stored pricing rules on a product to reduce its checkout price."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WC Fields Factory","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"4.1.11","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:28.017418Z","id":"CVE-2026-93508","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/a927f6d6-90d8-4b91-aed4-f5f53d2b5c64/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93510","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:06.057","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Points and Rewards for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.10.4","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:17.110125Z","id":"CVE-2026-93510","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/b721d8bb-2426-4635-a419-07074168bd82/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93511","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:06.163","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Premium Packages  WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Premium Packages","defaultStatus":"unaffected","versions":[{"version":"7.0.0","lessThan":"7.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:36:07.526399Z","id":"CVE-2026-93511","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-290"}]}],"references":[{"url":"https://wpscan.com/vulnerability/edc2f15c-a72b-47c2-ad38-e6f5a8441d72/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-93528","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T06:17:06.273","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"NP Quote Request for WooCommerce","defaultStatus":"unaffected","versions":[{"version":"2.0","lessThan":"2.4.16","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:55.272788Z","id":"CVE-2026-93528","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]}],"references":[{"url":"https://wpscan.com/vulnerability/f691b9cc-7d17-4308-9646-db842d99f63f/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-5924","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T07:16:45.720","lastModified":"2026-09-23T15:17:14.737","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval() on user-controlled block content in the frontend JavaScript mapStyles() function.  This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"jetmonsters","product":"Getwid – Gutenberg Blocks","defaultStatus":"unaffected","versions":[{"version":"2.1.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:10:04.811246Z","id":"CVE-2026-5924","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/getwid/tags/2.1.3/assets/blocks/map/frontend.js#L4","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/getwid/tags/2.1.3/includes/blocks/google-map.php#L139","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/getwid/trunk/assets/blocks/map/frontend.js#L4","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/getwid/trunk/includes/blocks/google-map.php#L139","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3514403%40getwid&new=3514403%40getwid","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a0db9693-df56-44d3-9167-c21e868c3f88?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-6831","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T07:16:45.883","lastModified":"2026-09-23T15:17:16.347","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to read all Contact Form 7 submission data via the 'acf7db' shortcode."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"vsourz1td","product":"Advanced Contact form 7 DB","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.1.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:13:08.060494Z","id":"CVE-2026-6831","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3587196%40advanced-cf7-db%2Ftags%2F2.1.2&old=3510776%40advanced-cf7-db%2Ftags%2F2.1.1","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b3c5fe0b-8a22-4df2-9adf-b6a7fe1a8a8c?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-82331","sourceIdentifier":"security@apache.org","published":"2026-09-23T07:16:46.493","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious source tarballs to write files on the host, with the privileges of the user running BuildStream, via symlinks as part of source fetching.\nThe impact of this issue is mitigated by:\n\n* BuildStream projects should only use trusted sources in their elements as otherwise the build output can also not be trusted\n* Tracking a source tarball pins its SHA256 hash, which prevents MITM attacks of users that are fetching an already tracked project\n* When running on Python >= 3.12, BuildStream >= 2.3.0 already makes use of the Python `tarfile` filter functionality, which blocks the symlink escape\n\nUsers are recommended to upgrade to version 2.8.1, which fixes this issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache BuildStream","defaultStatus":"unaffected","collectionURL":"https://pypi.python.org","packageName":"buildstream","packageURL":"pkg:pypi/BuildStream","versions":[{"version":"0","lessThanOrEqual":"2.8.0","versionType":"semver","status":"affected"},{"version":"2.8.1","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:55:37.367789Z","id":"CVE-2026-82331","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://lists.apache.org/thread/9b342631x7bvtyg0pq7zgywtl2cmy34v","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/9","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-50227","sourceIdentifier":"8fc372e3-d9c5-46e4-9410-38469745c639","published":"2026-09-23T08:17:09.383","lastModified":"2026-09-25T13:15:28.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software (versions up to and including 5.2.62). This allows the attacker to invoke exposed ddsc RPC functions, including child_process.execSync(), resulting in arbitrary command execution in the application context."}],"affected":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","affectedData":[{"vendor":"Acer","product":"NitroSense V5","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"*","lessThanOrEqual":"5.2.62","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:50:48.401965Z","id":"CVE-2026-50227","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","type":"Secondary","description":[{"lang":"en","value":"CWE-78"},{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://community.acer.com/en/kb/articles/20052","source":"8fc372e3-d9c5-46e4-9410-38469745c639"}]}},{"cve":{"id":"CVE-2026-50228","sourceIdentifier":"8fc372e3-d9c5-46e4-9410-38469745c639","published":"2026-09-23T08:17:10.493","lastModified":"2026-09-25T13:15:28.037","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution."}],"affected":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","affectedData":[{"vendor":"Acer","product":"NitroSense V5","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"*","lessThanOrEqual":"5.2.63","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:49:30.806462Z","id":"CVE-2026-50228","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"8fc372e3-d9c5-46e4-9410-38469745c639","type":"Secondary","description":[{"lang":"en","value":"CWE-489"}]}],"references":[{"url":"https://community.acer.com/en/kb/articles/20051","source":"8fc372e3-d9c5-46e4-9410-38469745c639"}]}},{"cve":{"id":"CVE-2026-91788","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:10.623","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"When implementing the JavaScript interface, Foxit PDF Editor/Reader did not perform the attribute authorization checks required by the specification. As a result, a trusted malicious PDF could potentially access sensitive content from other documents within the same process and transmit it externally."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.0,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:11:39.537445Z","id":"CVE-2026-91788","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-668"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-91789","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:10.753","lastModified":"2026-10-08T12:38:10.007","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor/Reader’s U3D/GIF texture decoding path contained insufficient validation of image dimensions and related size information. Under certain conditions, this could lead to an incorrectly sized memory allocation and a subsequent out-of-bounds write during pixel processing, potentially resulting in remote code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:14:41.947272Z","id":"CVE-2026-91789","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91790","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:10.873","lastModified":"2026-10-08T12:45:41.380","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When rendering the page image, Foxit PDF Editor/Reader fails to perform validation on image objects whose optional content attributes are malformed. As a result, the program may access an already-freed internal data structure, triggering a crash due to UAF."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:47:59.453112Z","id":"CVE-2026-91790","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91791","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:10.987","lastModified":"2026-10-08T12:52:52.453","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When processing a specially crafted PDF file, Foxit PDF Editor/Reader may encounter a reentrant execution condition involving JavaScript triggered by page-visibility events. This can cause the application to access a released page-view object while calculating annotation boundaries, resulting in an invalid memory read and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:47:41.583625Z","id":"CVE-2026-91791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91792","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.110","lastModified":"2026-10-08T13:20:31.513","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition and an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:47:21.562488Z","id":"CVE-2026-91792","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91793","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.223","lastModified":"2026-10-08T13:47:43.337","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"When opening a specially crafted PDF, Foxit PDF Editor/Reader executes scripts that modify annotation rich-text attributes containing malformed font data. During subsequent annotation appearance reconstruction, it accesses an object after it has been released, resulting in a use-after-free condition and an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:08.057542Z","id":"CVE-2026-91793","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91794","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.337","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An out-of-bounds write vulnerability exists in the PDF rendering process of Foxit PDF Editor/Reader due to insufficient consistency and boundary validation when processing malformed color space data, which may cause the program to crash and potentially lead to remote code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:58.965791Z","id":"CVE-2026-91794","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-91795","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.453","lastModified":"2026-10-08T13:48:36.860","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor/Reader's FileOpen plugin did not adequately validate certain encryption metadata in specially crafted PDF files. This could leave an internal pointer in an invalid state, resulting in chained read and write access violations and potentially enabling arbitrary code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:41.289496Z","id":"CVE-2026-91795","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-822"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91796","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.570","lastModified":"2026-10-08T13:49:03.810","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:46:24.585625Z","id":"CVE-2026-91796","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91797","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.683","lastModified":"2026-10-08T13:49:35.017","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor/Reader failed to validate the directory traversal path in the attachment file name, resulting in malicious attachments being able to be written to directories outside the expected secure area when the PDF is opened."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:25:36.693438Z","id":"CVE-2026-91797","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-73"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91798","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.793","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:40:51.697713Z","id":"CVE-2026-91798","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-91799","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:11.907","lastModified":"2026-10-08T13:50:42.047","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of JavaScript array objects. A specially crafted PDF may cause the application to access a released object during array processing, potentially resulting in application crashes or arbitrary code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:42:27.568894Z","id":"CVE-2026-91799","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91800","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.023","lastModified":"2026-10-15T15:06:29.017","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-modifiable configuration value during high-privilege upgrades. A local attacker could exploit this issue to execute arbitrary commands with root privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:45:25.566451Z","id":"CVE-2026-91800","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.6.63484","matchCriteriaId":"92336E4D-D9B0-4629-97D6-028308036214"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.68868","versionEndIncluding":"14.0.7.69441","matchCriteriaId":"C887A2B3-8FF9-4F97-9580-D085BEDE7201"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.55583","versionEndIncluding":"2023.3.0.63083","matchCriteriaId":"D8785CCE-C44C-4908-9133-13A580D5BECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.63682","versionEndIncluding":"2024.4.1.66479","matchCriteriaId":"CF043D20-0E28-481C-8756-D1301FAE67D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.66692","versionEndIncluding":"2025.3.0.69570","matchCriteriaId":"20698FD4-5E28-4206-ACEA-4FCD24AD23BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.70169","versionEndIncluding":"2026.2.0.72029","matchCriteriaId":"72510597-6566-4748-8F69-099EBF8B5D21"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.72029","matchCriteriaId":"3EAB06EC-F222-463E-9441-0A6A2FC06288"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91801","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.133","lastModified":"2026-10-08T13:55:02.527","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:45:04.691075Z","id":"CVE-2026-91801","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-22"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91802","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.247","lastModified":"2026-10-08T13:56:03.950","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s WebP image decoding due to improper handling of bitmap stride and target buffer formats. Successful exploitation could result in an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:42:49.234407Z","id":"CVE-2026-91802","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91803","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.363","lastModified":"2026-10-08T14:05:19.910","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacker could exploit this issue to execute code with elevated privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:40:30.695753Z","id":"CVE-2026-91803","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-427"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91804","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.477","lastModified":"2026-10-08T13:58:38.847","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s rendering of Circle annotations with malformed Cloudy appearance streams in specially crafted PDF files. Insufficient validation of the appearance geometry can result in memory corruption and application crashes."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:41:58.087529Z","id":"CVE-2026-91804","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91805","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.583","lastModified":"2026-10-08T12:20:30.497","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s PDF page-tree handling. A specially crafted PDF can trigger page-structure changes during rendering, causing the application to access released page objects and resulting in memory corruption and an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:45:45.596189Z","id":"CVE-2026-91805","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91806","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.693","lastModified":"2026-10-08T12:24:50.383","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF form fields. Embedded JavaScript may access form-field references after the corresponding fields have been released, resulting in an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:41:32.626461Z","id":"CVE-2026-91806","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91807","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.807","lastModified":"2026-10-15T14:48:42.840","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient validation of the soft-mask data attribute during image parsing may cause an arithmetic underflow, resulting in an out-of-bounds read and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:41:09.281583Z","id":"CVE-2026-91807","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.2.63349","matchCriteriaId":"2C7DEE55-1FE3-4B41-975D-BB926E9E69D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.68868","versionEndIncluding":"14.0.7.69441","matchCriteriaId":"C887A2B3-8FF9-4F97-9580-D085BEDE7201"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.55583","versionEndIncluding":"2023.3.0.63083","matchCriteriaId":"D8785CCE-C44C-4908-9133-13A580D5BECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.63682","versionEndIncluding":"2024.4.1.66479","matchCriteriaId":"CF043D20-0E28-481C-8756-D1301FAE67D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.66692","versionEndIncluding":"2025.3.0.69570","matchCriteriaId":"20698FD4-5E28-4206-ACEA-4FCD24AD23BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.70169","versionEndIncluding":"2026.2.0.72029","matchCriteriaId":"72510597-6566-4748-8F69-099EBF8B5D21"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.1.39815","matchCriteriaId":"A6C4B75F-C060-4B92-9646-0E621DB9BF63"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91808","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:12.930","lastModified":"2026-10-08T13:53:24.190","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor Reader’s handling of PDF image objects with inconsistent compression metadata. Insufficient validation during image decoding may result in an undersized buffer and an out-of-bounds read during rendering, causing an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:25:57.837671Z","id":"CVE-2026-91808","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91809","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.070","lastModified":"2026-10-08T14:04:38.777","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF form fields. Improper validation during field-name traversal may cause the application to access a released object, resulting in an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:26:26.832912Z","id":"CVE-2026-91809","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91810","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.190","lastModified":"2026-10-08T14:04:13.797","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:39:59.611591Z","id":"CVE-2026-91810","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91811","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.307","lastModified":"2026-10-15T14:10:54.133","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:39:37.958469Z","id":"CVE-2026-91811","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.2.63349","matchCriteriaId":"2C7DEE55-1FE3-4B41-975D-BB926E9E69D4"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.68868","versionEndIncluding":"14.0.7.69441","matchCriteriaId":"C887A2B3-8FF9-4F97-9580-D085BEDE7201"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.55583","versionEndIncluding":"2023.3.0.63083","matchCriteriaId":"D8785CCE-C44C-4908-9133-13A580D5BECB"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.63682","versionEndIncluding":"2024.4.1.66479","matchCriteriaId":"CF043D20-0E28-481C-8756-D1301FAE67D2"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.66692","versionEndIncluding":"2025.3.0.69570","matchCriteriaId":"20698FD4-5E28-4206-ACEA-4FCD24AD23BE"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.70169","versionEndIncluding":"2026.2.0.72029","matchCriteriaId":"72510597-6566-4748-8F69-099EBF8B5D21"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.1.39815","matchCriteriaId":"A6C4B75F-C060-4B92-9646-0E621DB9BF63"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*","matchCriteriaId":"387021A0-AF36-463C-A605-32EA7DAC172E"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91812","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.423","lastModified":"2026-10-08T14:02:28.507","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":7.9,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:39:13.903098Z","id":"CVE-2026-91812","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91813","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.550","lastModified":"2026-10-08T14:01:22.210","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could enable local attackers to execute arbitrary code with elevated privileges."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.0,"impactScore":6.0},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:37:19.640678Z","id":"CVE-2026-91813","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91814","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.673","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Undergoing Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A signature validation vulnerability exists in Foxit PDF Editor/Reader’s handling of incrementally updated PDF documents. Changes to visible document content may not invalidate the existing signature, allowing attackers to alter signed content and potentially carry out content spoofing while the document continues to appear validly signed."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows","MacOS"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:24:09.232400Z","id":"CVE-2026-91814","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-347"}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2"}]}},{"cve":{"id":"CVE-2026-91815","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.790","lastModified":"2026-10-08T14:00:25.370","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Foxit PDF Editor/Reader does not perform sufficient verification of the JPEG2000 image metadata in the PDF file, which leads to out-of-bounds write in the heap buffer during decoding, potentially causing the program to crash and introducing the risk of arbitrary code execution."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:24:42.700847Z","id":"CVE-2026-91815","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-787"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91816","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:13.900","lastModified":"2026-10-08T14:00:00.387","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s handling of PDF annotations. Reentrant annotation deletion triggered by embedded JavaScript can cause the application to access an annotation object after it has been released, resulting in a use-after-free condition and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:22:57.080981Z","id":"CVE-2026-91816","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91817","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:14.010","lastModified":"2026-10-01T20:23:59.847","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:22:00.125904Z","id":"CVE-2026-91817","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-91818","sourceIdentifier":"14984358-7092-470d-8f34-ade47a7658a2","published":"2026-09-23T08:17:14.123","lastModified":"2026-10-08T13:59:31.800","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash."}],"affected":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","affectedData":[{"vendor":"Foxit Software Inc.","product":"Foxit PDF Editor","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"},{"version":"Versions 14.0.7 and earlier","status":"affected"},{"version":"Versions 13.2.6 and earlier","status":"affected"}]},{"vendor":"Foxit Software Inc.","product":"Foxit PDF Reader","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"Versions 2026.2 and earlier","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:15:03.019532Z","id":"CVE-2026-91818","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"14984358-7092-470d-8f34-ade47a7658a2","type":"Secondary","description":[{"lang":"en","value":"CWE-416"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionEndIncluding":"13.2.5.63482","matchCriteriaId":"F56A28CE-B170-4EF6-9252-DAAAE95C8EFC"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"14.0.0.33046","versionEndIncluding":"14.0.7.33751","matchCriteriaId":"ACB35909-C2E9-45E0-A63D-A80DCD8ECC24"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2023.1.0.15510","versionEndIncluding":"2023.3.0.23028","matchCriteriaId":"0C75FEE6-54F3-49C6-BAEA-A09D23BE5D64"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2024.1.0.23997","versionEndIncluding":"2024.4.1.27687","matchCriteriaId":"2C06BC41-9831-4AE3-B10B-3FC313D01580"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2025.1.0.27937","versionEndIncluding":"2025.3.0.35737","matchCriteriaId":"AD0AAFC0-5B9B-4A11-8967-4699792850F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_editor:*:*:*:*:*:*:*:*","versionStartIncluding":"2026.1.0.36452","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"757FC908-7C20-4D94-B5E4-83590D451EA1"},{"vulnerable":true,"criteria":"cpe:2.3:a:foxit:pdf_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"2026.2.0.39747","matchCriteriaId":"379C8399-B43C-47AE-BA7B-0FAC7682BF7B"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*","matchCriteriaId":"A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}],"references":[{"url":"https://www.foxit.com/support/security-bulletins.html","source":"14984358-7092-470d-8f34-ade47a7658a2","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-92378","sourceIdentifier":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","published":"2026-09-23T08:17:14.237","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"A session management\nvulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware\nuniFLOW Online. Under specific timing conditions during Service Offline\nEmergency Mode, a previously authenticated session may be retained after\nlogout, which could allow a subsequent user to be authenticated as the previous\nuser and gain unauthorised limited access to device functionality."}],"affected":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","affectedData":[{"vendor":"NT-ware","product":"uniFLOW Online","defaultStatus":"unaffected","platforms":["Web Application"],"versions":[{"version":"0","lessThanOrEqual":"2026.2","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"PHYSICAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:48:32.843106Z","id":"CVE-2026-92378","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"references":[{"url":"https://ntware.atlassian.net/wiki/spaces/SA/pages/14160592897/Security+Advisory+Previous+login+session+retained+when+entering+Reduced+Function+Login","source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"},{"url":"https://www.canon-europe.com/psirt/advisory-information/","source":"4586e0a2-224d-4f8a-9cb4-8882b208c0b3"}]}},{"cve":{"id":"CVE-2026-15027","sourceIdentifier":"twcert@cert.org.tw","published":"2026-09-23T09:17:07.657","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer."}],"affected":[{"source":"twcert@cert.org.tw","affectedData":[{"vendor":"Changing","product":"CGServiSign","defaultStatus":"unaffected","platforms":["Linux"],"versions":[{"version":"1.0.23.1227","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"twcert@cert.org.tw","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:10:48.482227Z","id":"CVE-2026-15027","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"twcert@cert.org.tw","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11214-89281-2.html","source":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11213-28a81-1.html","source":"twcert@cert.org.tw"}]}},{"cve":{"id":"CVE-2026-31377","sourceIdentifier":"security@apache.org","published":"2026-09-23T09:17:08.380","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints.\n\n\n\nThe affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information.\n\n\n\nThis issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability.\n\n\n\n\nUsers are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Doris","defaultStatus":"unknown","modules":["Frontend (FE) meta service"],"programFiles":["fe/fe-core/src/main/java/org/apache/doris/httpv2/meta/MetaService.java"],"versions":[{"version":"2.0.0","lessThan":"4.0.8","versionType":"semver","status":"affected"},{"version":"4.1.0","lessThan":"4.1.4","versionType":"semver","status":"affected"},{"version":"0","lessThan":"2.0.0","versionType":"semver","status":"unaffected"},{"version":"4.0.8","lessThan":"4.1.0","versionType":"semver","status":"unaffected"},{"version":"4.1.4","lessThan":"*","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@apache.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:06:33.070831Z","id":"CVE-2026-31377","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://lists.apache.org/thread/rf4ocqmzxvnwnxpsooj2lkzjl68b1m9q","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/10","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-42801","sourceIdentifier":"68630edc-a58c-4cbd-9b01-0e130455c8ae","published":"2026-09-23T09:17:08.727","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation.\n\nThis vulnerability is associated with program file 3g.mod/lib/src/urrsir.c."}],"affected":[{"source":"68630edc-a58c-4cbd-9b01-0e130455c8ae","affectedData":[{"vendor":"ASR","product":"Crane，Falcon","defaultStatus":"unaffected","modules":["as_rrc"],"platforms":["Linux"],"programFiles":["3g.mod/lib/src/urrsir.c"],"versions":[{"version":"0","lessThan":"2026/9/20","versionType":"date","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"68630edc-a58c-4cbd-9b01-0e130455c8ae","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.1,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:25:08.195447Z","id":"CVE-2026-42801","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"68630edc-a58c-4cbd-9b01-0e130455c8ae","type":"Secondary","description":[{"lang":"en","value":"CWE-476"}]}],"references":[{"url":"https://www.asrmicro.com/en/goods/psirt?cid=45","source":"68630edc-a58c-4cbd-9b01-0e130455c8ae"}]}},{"cve":{"id":"CVE-2026-93368","sourceIdentifier":"security@wordfence.com","published":"2026-09-23T09:17:09.247","lastModified":"2026-09-23T19:19:45.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress core applies wp_unslash() to the 'log' POST value before dispatching the wp_login_failed action, stripping magic-quotes backslash escaping and allowing a raw single quote to reach the plugin's handler unimpeded."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"travispluse","product":"Rename wp-login.php to anything you want","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:37:24.330305Z","id":"CVE-2026-93368","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L217","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L388","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L398","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L421","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/89a07c47-b57c-49de-9f7c-a2bb29e3fecc?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-95625","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T09:17:09.393","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update manifest -- which contains the version number, download URL, and signature -- is fetched over TLS but is never itself signed or authenticated. Because the only anti-rollback check compares the manifest's version field against the current version, and that field is unsigned, an attacker who can serve a crafted manifest can force installation of any older signed release without possessing the developer's private key."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Tauri","product":"tauri-plugin-updater","defaultStatus":"unaffected","collectionURL":"https://crates.io/crates/tauri-plugin-updater","packageName":"tauri-plugin-updater","programFiles":["plugins/updater/src/updater.rs","plugins/updater/src/config.rs"],"repo":"git://github.com/tauri-apps/plugins-workspace","versions":[{"version":"2.0.0","lessThan":"2.12.0","versionType":"semver","status":"affected"},{"version":"2.12.0","lessThanOrEqual":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":0.7,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:07:42.715205Z","id":"CVE-2026-95625","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-354"}]}],"references":[{"url":"https://github.com/tauri-apps/plugins-workspace","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/plugins-workspace/commit/690dcfd694","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/plugins-workspace/releases/tag/updater-v2.12.0","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-j38x-g3m3-95fr","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-73192","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:07.660","lastModified":"2026-09-30T16:14:33.617","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library.\n\nUpgrade to Apache Sling XSS >= 2.4.12"}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:05:46.959656Z","id":"CVE-2026-73192","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://sling.apache.org/news.html","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/18","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-79616","sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","published":"2026-09-23T10:17:07.803","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Out-of-bounds read while parsing untrusted SVG path strings in Qt Quick's Context2D.path / PathSvg.path."}],"affected":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","affectedData":[{"vendor":"qt","product":"qt","defaultStatus":"unaffected","modules":["qtdeclarative"],"versions":[{"version":"5.10.0","lessThanOrEqual":"6.8.8","versionType":"python","status":"affected"},{"version":"6.9.0","lessThanOrEqual":"6.11.1","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:U/V:X/RE:L/U:Green","baseScore":0.6,"baseSeverity":"LOW","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"USER","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"LOW","providerUrgency":"GREEN"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:23:55.405900Z","id":"CVE-2026-79616","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","description":[{"lang":"en","value":"CWE-125"}]}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtdeclarative/+/754718","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}]}},{"cve":{"id":"CVE-2026-91852","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:07.960","lastModified":"2026-09-30T16:13:54.047","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:04:21.554097Z","id":"CVE-2026-91852","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://lists.apache.org/thread/nd0ncdk5qb9gqvn0s10rmhnbk887k1qo","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"https://sling.apache.org/news.html","source":"security@apache.org","tags":["Product"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-91928","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.080","lastModified":"2026-09-30T16:12:41.497","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:02:16.525807Z","id":"CVE-2026-91928","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://lists.apache.org/thread/yfb1q6zob8mth5lr4jnsy3lhx9rfwb02","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/13","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-91999","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.200","lastModified":"2026-09-30T16:11:12.213","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:05:07.662459Z","id":"CVE-2026-91999","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://lists.apache.org/thread/xpcsdkr80ow9p13f7hp3ykrhzky9d4t4","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/14","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-92001","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.323","lastModified":"2026-09-30T15:59:43.950","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling XSS","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"2.4.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:14:39.290915Z","id":"CVE-2026-92001","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-776"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_xss_protection_api:*:*:*:*:*:*:*:*","versionEndExcluding":"2.4.12","matchCriteriaId":"3CA9B2A4-F494-42A5-81EE-030CA5B656D7"}]}]}],"references":[{"url":"https://lists.apache.org/thread/m52jll26vc8g5jokbg0xt062o09wkghr","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/15","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-94243","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.440","lastModified":"2026-10-06T13:55:01.483","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.\n\n\n\nThis issue affects Apache Sling Security Bundle: before 1.3.2.\n\n\n\nUsers are recommended to upgrade to version 1.3.2, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling Security Bundle","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:16:29.466249Z","id":"CVE-2026-94243","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-346"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_security:*:*:*:*:*:*:*:*","versionEndExcluding":"1.3.2","matchCriteriaId":"ADE86A72-0C94-4189-9257-D2693EEBA930"}]}]}],"references":[{"url":"https://lists.apache.org/thread/ohz47f6hrflsjvt9m24qz69qm5w4bwyr","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/16","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-94251","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.557","lastModified":"2026-10-06T13:54:26.543","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource\n\n\n\nThis issue affects Apache Sling Security Bundle: before 1.3.12.\n\n\n\nUsers are recommended to upgrade to version 1.3.12, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Sling Security Bundle","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"1.3.12","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:20:37.552496Z","id":"CVE-2026-94251","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:sling_security:*:*:*:*:*:*:*:*","versionEndExcluding":"1.3.2","matchCriteriaId":"ADE86A72-0C94-4189-9257-D2693EEBA930"}]}]}],"references":[{"url":"https://lists.apache.org/thread/7zo0drh75qmk1xn7940hy4pxjs6h2b10","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/17","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-95626","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T10:17:08.677","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Tauri","product":"tauri","defaultStatus":"unaffected","collectionURL":"https://crates.io/crates/tauri","packageName":"tauri","programFiles":["crates/tauri-utils/src/html.rs","crates/tauri/src/manager/mod.rs"],"repo":"git://github.com/tauri-apps/tauri","versions":[{"version":"2.0.0","lessThanOrEqual":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:03:10.553800Z","id":"CVE-2026-95626","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/tauri-apps/tauri","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/tauri/security/advisories/GHSA-6vxm-x265-58qf","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-95627","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T10:17:08.810","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Tauri","product":"tauri-plugin-dialog","defaultStatus":"unaffected","collectionURL":"https://crates.io/crates/tauri-plugin-dialog","packageName":"tauri-plugin-dialog","programFiles":["plugins/dialog/src/commands.rs"],"repo":"git://github.com/tauri-apps/plugins-workspace","versions":[{"version":"2.0.0","lessThanOrEqual":"*","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:21:31.658846Z","id":"CVE-2026-95627","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-732"}]}],"references":[{"url":"https://github.com/tauri-apps/plugins-workspace","source":"reefs@jfrog.com"},{"url":"https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-vw89-89jm-wmqc","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-96443","sourceIdentifier":"security@apache.org","published":"2026-09-23T10:17:08.943","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Doris","defaultStatus":"unaffected","versions":[{"version":"2.0.5","lessThanOrEqual":"4.1.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:14:14.842142Z","id":"CVE-2026-96443","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-829"}]}],"references":[{"url":"https://lists.apache.org/thread/vv9o8sxpt8kkd7nznhovn9qjojn2wyv9","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/11","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-96454","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T10:17:09.070","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content.\n\n\n\nThe first is in src-tauri/capabilities/default.json, which grants IPC access with \"remote\": { \"urls\": [\"https://*.*\"] }. That wildcard tells Tauri to accept IPC from any HTTPS origin, not just the site the application was built to wrap. The second is \"withGlobalTauri\": true in src-tauri/tauri.conf.json, which puts window.__TAURI__.core.invoke() in reach of ordinary page JavaScript.\n\n\n\nTauri's access control list only checks plugin commands, the ones prefixed with plugin:. Commands the application registers itself through generate_handler!, known as app commands, are never checked against the ACL. So once an origin holds IPC access, it can call every app command with nothing else standing in the way. Pake registers download_file as an app command, and it does not appear in the permissions list because it does not need to.\n\n\n\nThe practical effect is that any script running on any HTTPS page inside a Pake application can invoke the application's native commands. That includes third-party script the wrapped site loads on its own, such as analytics, advertising, or a compromised CDN. Anyone distributing their own Pake application gets the same access without asking for it. Chained with the path traversal in download_file that is tracked separately as CVE-2026-82635, this reaches arbitrary file write and persistent code execution."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"tw93","product":"Pake","defaultStatus":"affected","collectionURL":"https://registry.npmjs.org","packageName":"pake-cli","platforms":["macOS","Windows","Linux"],"programFiles":["src-tauri/capabilities/default.json","src-tauri/tauri.conf.json"],"repo":"https://github.com/tw93/Pake","versions":[{"version":"0","lessThanOrEqual":"3.17.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:01:27.089525Z","id":"CVE-2026-96454","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"},{"lang":"en","value":"CWE-923"}]}],"references":[{"url":"https://github.com/tw93/Pake","source":"reefs@jfrog.com"},{"url":"https://github.com/tw93/Pake/blob/main/src-tauri/capabilities/default.json","source":"reefs@jfrog.com"},{"url":"https://github.com/tw93/Pake/blob/main/src-tauri/tauri.conf.json","source":"reefs@jfrog.com"},{"url":"https://github.com/tw93/Pake/releases/tag/V3.17.0","source":"reefs@jfrog.com"},{"url":"https://v2.tauri.app/security/capabilities/","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-5695","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-23T11:17:10.590","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely (demonstrated by uploading the EICAR test file), which could result in the system being completely compromised."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Microweber","product":"Administration panel","defaultStatus":"unaffected","versions":[{"version":"2.0.19","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:46:21.222532Z","id":"CVE-2026-5695","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-434"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-5696","sourceIdentifier":"cve-coordination@incibe.es","published":"2026-09-23T11:17:10.730","lastModified":"2026-09-24T14:45:22.827","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session."}],"affected":[{"source":"cve-coordination@incibe.es","affectedData":[{"vendor":"Microweber","product":"Administration panel","defaultStatus":"unaffected","versions":[{"version":"2.0.19","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"cve-coordination@incibe.es","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:09:23.700269Z","id":"CVE-2026-5696","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve-coordination@incibe.es","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-microweber-administration-panel","source":"cve-coordination@incibe.es"}]}},{"cve":{"id":"CVE-2026-86601","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:13.970","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"WP Recipe Maker","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"10.8.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:42.790665Z","id":"CVE-2026-86601","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://wpscan.com/vulnerability/be6b1fb1-222d-4563-8a19-41bed1960001/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86604","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:14.410","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"GTranslate","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"5.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:27.635210Z","id":"CVE-2026-86604","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://wpscan.com/vulnerability/07c6e3a2-e8fe-4b25-a5d8-b5ed812100af/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86612","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:14.730","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Ninja Tables","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"5.2.17","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":5.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:33.838232Z","id":"CVE-2026-86612","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"references":[{"url":"https://wpscan.com/vulnerability/4be7a5e0-9657-4692-904d-b696224e32ec/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87070","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:15.333","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Forminator Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"1.57.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:35:03.336464Z","id":"CVE-2026-87070","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-348"}]}],"references":[{"url":"https://wpscan.com/vulnerability/3206e88e-5d29-4897-863e-101dc9b33ec5/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87071","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:15.463","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Forminator Forms","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"1.57.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:34:54.159284Z","id":"CVE-2026-87071","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://wpscan.com/vulnerability/9d831b9d-c05d-4b9a-8b65-7e1e35e68510/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87848","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:15.750","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt of arbitrary posts, including private, draft, pending, trashed and password-protected ones."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"MPCX Lightbox","defaultStatus":"unknown","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"1.2.2","lessThanOrEqual":"1.2.5","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:34:47.454361Z","id":"CVE-2026-87848","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://wpscan.com/vulnerability/183ec34f-446f-481f-9019-26e005ad2cfb/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-87978","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:15.880","lastModified":"2026-09-23T18:13:31.210","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid without any payment."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paymob for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"4.1.14","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:34:41.598724Z","id":"CVE-2026-87978","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-345"}]}],"references":[{"url":"https://wpscan.com/vulnerability/7eecf65a-3b85-405e-bbe2-893960c82ba7/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-90950","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T11:17:16.773","lastModified":"2026-09-23T18:12:32.050","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"Paid Membership Subscriptions","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"2.0.5","lessThan":"3.1.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T10:34:34.838195Z","id":"CVE-2026-90950","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-693"}]}],"references":[{"url":"https://wpscan.com/vulnerability/685f381e-97b5-4855-a0ca-5854043a7b9e/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-96442","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T11:17:18.550","lastModified":"2026-10-20T00:19:27.883","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A code execution flaw was found in Emacs, affecting versions prior to 31.2. The Flymake mode using language backends other than Lisp would execute arbitrary code from the edited file while performing syntax checking. Viewing or editing untrusted files using Emacs could lead to arbitrary code execution with the privileges of the user running Emacs."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"GNU Emacs","product":"GNU Emacs","defaultStatus":"unaffected","collectionURL":"https://git.savannah.gnu.org/cgit/emacs.git/","packageName":"emacs","versions":[{"version":"0","lessThan":"31.2","versionType":"semver","status":"affected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"1:29.4-14.el10_2.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream"],"versions":[{"version":"1:27.2-18.el9_8.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"emacs","cpes":["cpe:/o:redhat:enterprise_linux:8"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:54:08.909184Z","id":"CVE-2026-96442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:84591","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:85245","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96442","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2537347","source":"secalert@redhat.com"},{"url":"https://github.com/emacs-mirror/emacs/commit/135e6f63f08fee3d374fa1a5187bce941a2d3e3c","source":"secalert@redhat.com"},{"url":"https://github.com/emacs-mirror/emacs/commit/abc802ee2eb0b1663349ddf22a461f8e54a383fb","source":"secalert@redhat.com"},{"url":"https://www.openwall.com/lists/oss-security/2026/09/14/1","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96455","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T11:17:18.690","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just hands back the manager object from application state, so nothing in the chain ever checks a credential.\n\n\n\nThe endpoint takes an AppInfo body naming a Hugging Face Space. The daemon downloads that Space and installs it as a Python package through install_package in src/reachy_mini/apps/sources/local_common_venv.py, using uv or pip. Installing a Python package runs the package's own build and setup code, so whoever chooses the Space chooses what code the robot runs. Anyone can publish a public Hugging Face Space, so this is not a meaningful restriction on the attacker.\n\n\n\nHow far this reaches depends on the model. In _resolve_bind_host in src/reachy_mini/daemon/app/main.py the daemon binds 0.0.0.0 when it runs as the wireless version and 127.0.0.1 otherwise, with the vendor's own comment explaining that the robot has to be reachable on the LAN. On a wireless unit, then, any host on the same network can install and run code on the robot without credentials.\n\n\n\nOne related change has already shipped but does not fix this. Version 1.8.2 replaced the wildcard CORS policy with an allow list of localhost and Tauri origins. That closes the browser drive-by route, where a web page the victim visits silently calls the endpoint in the background. It has no effect on this issue: CORS is enforced by browsers and governs whether script may read a response, while a direct HTTP request from another machine on the network involves no browser, no preflight and no CORS check at all."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Pollen Robotics","product":"Reachy Mini","defaultStatus":"affected","collectionURL":"https://pypi.org","packageName":"reachy_mini","platforms":["Linux"],"programFiles":["src/reachy_mini/daemon/app/routers/apps.py","src/reachy_mini/daemon/app/main.py","src/reachy_mini/apps/sources/local_common_venv.py"],"programRoutines":[{"name":"install_app"},{"name":"install_package"},{"name":"_resolve_bind_host"}],"repo":"https://github.com/pollen-robotics/reachy_mini","versions":[{"version":"0","lessThanOrEqual":"1.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:59:27.912505Z","id":"CVE-2026-96455","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"},{"lang":"en","value":"CWE-494"}]}],"references":[{"url":"https://github.com/pollen-robotics/reachy_mini","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/blob/main/src/reachy_mini/daemon/app/main.py","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/blob/main/src/reachy_mini/daemon/app/routers/apps.py","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/pull/1207","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/releases/tag/v1.11.0","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-96456","sourceIdentifier":"reefs@jfrog.com","published":"2026-09-23T11:17:18.843","lastModified":"2026-09-23T19:42:02.350","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication.\n\n\n\nThe authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler therefore has no idea which device sent a given write, and it cannot tell the authenticated one from any other.\n\n\n\nOnce any device completes the PIN exchange, the flag is set and every nearby device can send CMD_ commands until it resets. An attacker simply waits within radio range for a legitimate user to authenticate, then writes commands into the same window. No PIN is ever guessed or brute-forced.\n\n\n\nThis is the second step of a three-step chain that JFrog documented against the robot. The first is the unrestricted file upload in the media sounds API, tracked as CVE-2026-55419, which places an attacker-controlled script on the filesystem. This issue then provides command access over Bluetooth. The third is the Bluetooth command handler path traversal, tracked as CVE-2026-62661, which runs that script as root."}],"affected":[{"source":"reefs@jfrog.com","affectedData":[{"vendor":"Pollen Robotics","product":"Reachy Mini","defaultStatus":"affected","collectionURL":"https://pypi.org","packageName":"reachy_mini","platforms":["Linux"],"programFiles":["src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py"],"programRoutines":[{"name":"WriteValue"}],"repo":"https://github.com/pollen-robotics/reachy_mini","versions":[{"version":"0","lessThanOrEqual":"1.11.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"reefs@jfrog.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.1,"impactScore":3.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:56:00.359870Z","id":"CVE-2026-96456","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"reefs@jfrog.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://github.com/pollen-robotics/reachy_mini","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/blob/main/src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py","source":"reefs@jfrog.com"},{"url":"https://github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-993g-hgjh-whmf","source":"reefs@jfrog.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55419","source":"reefs@jfrog.com"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-62661","source":"reefs@jfrog.com"}]}},{"cve":{"id":"CVE-2026-12370","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:05.373","lastModified":"2026-09-24T14:17:11.450","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.668","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine NetFlow Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.668","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Network Configuration Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.668","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T03:55:27.041850Z","id":"CVE-2026-12370","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-12370.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-14913","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:05.507","lastModified":"2026-09-24T04:17:39.397","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.670","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.670","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-14913","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-14913.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-15358","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:05.630","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.671","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Network Configuration Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.671","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:34:27.546462Z","id":"CVE-2026-15358","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-428"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-15358.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-73581","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.287","lastModified":"2026-09-30T15:22:34.000","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0-M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThan":"8.5.0","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:19:35.322766Z","id":"CVE-2026-73581","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-299"}]}],"references":[{"url":"https://lists.apache.org/thread/r0dj3h1pbn4wv96fhsfrnz3t6874t6do","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/19","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-75973","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.410","lastModified":"2026-09-23T19:19:14.230","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M4","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:28:51.510257Z","id":"CVE-2026-75973","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://lists.apache.org/thread/njjcdkkzqyzx4n3ffc4ffjmyh5mpl1gr","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/20","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-76183","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.537","lastModified":"2026-09-30T15:22:34.470","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOS at the time the CVE was created but are \nknown to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"7.0.43","lessThanOrEqual":"7.0.109","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.0.43","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:33:34.949308Z","id":"CVE-2026-76183","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-289"}]}],"references":[{"url":"https://lists.apache.org/thread/45mxk8nj2q8pkhct6lfxkvtm2jpywrsp","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/21","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-77756","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.663","lastModified":"2026-09-23T19:19:18.720","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.47","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.67","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:18:16.430403Z","id":"CVE-2026-77756","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj2794vhor7o6xl3z","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/22","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-77762","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.800","lastModified":"2026-09-30T15:22:35.070","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.39 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.59 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.39","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.59","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:40:01.556894Z","id":"CVE-2026-77762","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-362"}]}],"references":[{"url":"https://lists.apache.org/thread/y5r9fvjo7ol24mkoyoc0st8bqrfyqcyn","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/23","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-77791","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:06.927","lastModified":"2026-09-23T19:19:19.043","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M5 through 11.0.25, from 10.1.8 through 10.1.59, from 9.0.74 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.88 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M5","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.8","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.74","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.88","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:44:33.453302Z","id":"CVE-2026-77791","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-400"}]}],"references":[{"url":"https://lists.apache.org/thread/mb1pjjooqytrl6hbvbt3rw1lqwlon4cz","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/24","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-78253","sourceIdentifier":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","published":"2026-09-23T12:17:07.063","lastModified":"2026-09-24T21:08:22.573","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document."}],"affected":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","affectedData":[{"vendor":"qt","product":"qt","defaultStatus":"unaffected","modules":["qtbase"],"versions":[{"version":"5.0.0","lessThanOrEqual":"6.8.8","versionType":"python","status":"affected"},{"version":"6.9.0","lessThanOrEqual":"6.11.1","versionType":"python","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:X/RE:L/U:Green","baseScore":2.3,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NEGLIGIBLE","Automatable":"NO","Recovery":"USER","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"LOW","providerUrgency":"GREEN"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:35:55.687793Z","id":"CVE-2026-78253","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3","type":"Secondary","description":[{"lang":"en","value":"CWE-674"}]}],"references":[{"url":"https://codereview.qt-project.org/c/qt/qtbase/+/754345","source":"a59d8014-47c4-4630-ab43-e1b13cbe58e3"}]}},{"cve":{"id":"CVE-2026-78383","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:07.213","lastModified":"2026-09-23T19:19:21.470","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"7.0.0","lessThanOrEqual":"7.0.109","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:44:38.108504Z","id":"CVE-2026-78383","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-770"}]}],"references":[{"url":"https://lists.apache.org/thread/tyqcqk99g7ghgk22641vf67vghcyswnw","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/25","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-78437","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:07.340","lastModified":"2026-09-23T19:19:21.640","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.19","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.53","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.116","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":3.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:25:38.365317Z","id":"CVE-2026-78437","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-459"}]}],"references":[{"url":"https://lists.apache.org/thread/qkmsos3s8chn5053qr466rzwv6sk5gjg","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/26","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-79677","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:07.593","lastModified":"2026-09-23T19:19:28.493","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.43 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"7.0.43","lessThanOrEqual":"7.0.109","versionType":"semver","status":"affected"},{"version":"0","lessThan":"7.0.43","versionType":"semver","status":"unaffected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:05:21.474452Z","id":"CVE-2026-79677","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-772"},{"lang":"en","value":"CWE-1025"}]}],"references":[{"url":"https://lists.apache.org/thread/bzwps6ck4szf2hmksbbon3syyl9qnkv8","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/27","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-80444","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-23T12:17:07.723","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation.\n\nThis issue affects AVESİS: from 202608201331 before 202608240351."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Abis Technology Ltd. Co.","product":"AVESİS","defaultStatus":"unaffected","versions":[{"version":"202608201331","lessThan":"202608240351","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:37:28.642604Z","id":"CVE-2026-80444","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Secondary","description":[{"lang":"en","value":"CWE-601"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1159","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-84787","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:07.857","lastModified":"2026-09-24T04:18:02.883","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-84787","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-250"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-84787.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-84789","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:07.983","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:42:46.343667Z","id":"CVE-2026-84789","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-84789.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-84791","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T12:17:08.110","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:42:10.958434Z","id":"CVE-2026-84791","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-84791.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86248","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:08.237","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M14 through 11.0.25, from 10.1.22 through 10.1.59, from 9.0.92 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M14","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.22","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.92","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:14:53.442167Z","id":"CVE-2026-86248","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://lists.apache.org/thread/nmkmjp9l53y8h3oc4n8fc0bkw9dv15sk","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-86350","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:08.350","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.22","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.55","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.118","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:16:46.410403Z","id":"CVE-2026-86350","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-444"}]}],"references":[{"url":"https://lists.apache.org/thread/mss45z99lcdd5dtpgcn45dy82f3toswc","source":"security@apache.org"}]}},{"cve":{"id":"CVE-2026-87022","sourceIdentifier":"security@apache.org","published":"2026-09-23T12:17:08.640","lastModified":"2026-09-23T19:19:42.183","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121.\n\n\n\nThe following versions were EOS at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.56 through 7.0.109. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.1.22, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat","defaultStatus":"unaffected","versions":[{"version":"11.0.0-M1","lessThanOrEqual":"11.0.25","versionType":"semver","status":"affected"},{"version":"10.1.0-M1","lessThanOrEqual":"10.1.59","versionType":"semver","status":"affected"},{"version":"9.0.0.M1","lessThanOrEqual":"9.0.121","versionType":"semver","status":"affected"},{"version":"8.5.0","lessThanOrEqual":"8.5.100","versionType":"semver","status":"affected"},{"version":"7.0.56","lessThanOrEqual":"7.0.109","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:27:17.688403Z","id":"CVE-2026-87022","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-130"}]}],"references":[{"url":"https://lists.apache.org/thread/ypvlkjqsq0480fnk9jm6h9qllddwlw4w","source":"security@apache.org"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/30","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-96445","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T12:17:08.773","lastModified":"2026-09-24T14:51:56.593","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Conditional OTP authenticator of Keycloak, an identity and access management solution. The issue occurs when the system evaluates specific HTTP headers to determine if a one-time password (OTP) should be skipped, but fails to verify if those headers came from a trusted source. This could allow an attacker who already has a user's password to bypass the second-factor authentication by providing a specially crafted header in their request."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:18:59.386636Z","id":"CVE-2026-96445","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96445","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539280","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-96446","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T12:17:08.913","lastModified":"2026-09-26T23:16:40.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.2,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:45:14.542570Z","id":"CVE-2026-96446","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-96446","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539284","source":"secalert@redhat.com"}]}},{"cve":{"id":"CVE-2026-19599","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:27.400","lastModified":"2026-09-24T04:17:48.027","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-19599","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-19599.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-75825","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:28.557","lastModified":"2026-09-24T04:17:55.500","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.711","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-75825","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-75825.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-76978","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:29.153","lastModified":"2026-09-24T04:17:59.137","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]},{"vendor":"ZohoCorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-76978","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-76978.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-76979","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:29.273","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]},{"vendor":"ZohoCorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:01:09.425453Z","id":"CVE-2026-76979","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-91"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-76979.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-76980","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T13:17:29.393","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine OpManager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]},{"vendor":"Zohocorp","product":"ManageEngine Firewall Analyzer","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"12.8.710","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:38:35.264539Z","id":"CVE-2026-76980","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://www.manageengine.com/itom/advisory/cve-2026-76980.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-77112","sourceIdentifier":"iletisim@usom.gov.tr","published":"2026-09-23T13:17:29.680","lastModified":"2026-09-23T17:58:00.627","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery.\n\nThis issue affects Weoll: before 3.2.45.44."}],"affected":[{"source":"iletisim@usom.gov.tr","affectedData":[{"vendor":"Global IT Informatics Technology Services Inc.","product":"Weoll","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"3.2.45.44","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"iletisim@usom.gov.tr","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:39:22.621078Z","id":"CVE-2026-77112","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"iletisim@usom.gov.tr","type":"Primary","description":[{"lang":"en","value":"CWE-918"}]}],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1160","source":"iletisim@usom.gov.tr"}]}},{"cve":{"id":"CVE-2026-84091","sourceIdentifier":"contact@wpscan.com","published":"2026-09-23T13:17:30.623","lastModified":"2026-09-24T14:42:02.707","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment."}],"affected":[{"source":"contact@wpscan.com","affectedData":[{"vendor":"Unknown","product":"SUMIT Payment Gateway for WooCommerce","defaultStatus":"unaffected","collectionURL":"https://wordpress.org/plugins","versions":[{"version":"0","lessThan":"4.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"contact@wpscan.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T12:35:44.939195Z","id":"CVE-2026-84091","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","description":[{"lang":"en","value":"CWE-287"}]}],"references":[{"url":"https://wpscan.com/vulnerability/10c7a9bd-eac0-49eb-9238-d7c477312166/","source":"contact@wpscan.com"}]}},{"cve":{"id":"CVE-2026-86243","sourceIdentifier":"security@apache.org","published":"2026-09-23T13:17:30.993","lastModified":"2026-10-06T13:53:46.107","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier, unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 1.3.9 or 2.0.16, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThanOrEqual":"2.0.15","versionType":"semver","status":"affected"},{"version":"1.3.0","lessThanOrEqual":"1.3.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:28:53.132953Z","id":"CVE-2026-86243","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-126"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"1.3.9","matchCriteriaId":"F73CA9D6-BD48-4223-B2AC-6F345E0895C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.16","matchCriteriaId":"AC3D1E2E-A1EE-4F33-8D7F-11D37A8AAE66"}]}]}],"references":[{"url":"https://lists.apache.org/thread/8p4jf02w54m22x0cwpq2x53w3ov8o557","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/31","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-86246","sourceIdentifier":"security@apache.org","published":"2026-09-23T13:17:31.117","lastModified":"2026-10-06T13:50:57.873","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Initialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default  including ALLOW_CLIENT_RENEGOTIATION, NO_EXTENDED_MASTER_SECRET, IGNORE_UNEXPECTED_EOF and ALLOW_NO_DHE_KEX.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Earlier unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fix the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThanOrEqual":"2.0.15","versionType":"semver","status":"affected"},{"version":"1.3.0","lessThanOrEqual":"1.3.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:29:46.583140Z","id":"CVE-2026-86246","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-1188"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"1.3.9","matchCriteriaId":"F73CA9D6-BD48-4223-B2AC-6F345E0895C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.16","matchCriteriaId":"AC3D1E2E-A1EE-4F33-8D7F-11D37A8AAE66"}]}]}],"references":[{"url":"https://lists.apache.org/thread/dgyvfwb24nbk45ptvlhdyhdhl5o7k5ol","source":"security@apache.org","tags":["Vendor Advisory","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/32","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-86247","sourceIdentifier":"security@apache.org","published":"2026-09-23T13:17:31.237","lastModified":"2026-10-06T13:46:49.633","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some configurations.\n\n\n\nThis issue affects Apache Tomcat Native: from 2.0.0 through 2.0.15, from 1.3.0 through 1.3.8. Unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 2.0.16 or 1.3.9, which fixes the issue."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Tomcat Native","defaultStatus":"unaffected","versions":[{"version":"2.0.0","lessThanOrEqual":"2.0.15","versionType":"semver","status":"affected"},{"version":"1.3.0","lessThanOrEqual":"1.3.8","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:30:32.467469Z","id":"CVE-2026-86247","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-366"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"1.3.0","versionEndExcluding":"1.3.9","matchCriteriaId":"F73CA9D6-BD48-4223-B2AC-6F345E0895C6"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:tomcat_native:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.16","matchCriteriaId":"AC3D1E2E-A1EE-4F33-8D7F-11D37A8AAE66"}]}]}],"references":[{"url":"https://lists.apache.org/thread/obsson6zhvfg0wsp2bx602l61ltj87r1","source":"security@apache.org","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/09/23/33","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]}]}},{"cve":{"id":"CVE-2026-95676","sourceIdentifier":"5d1c2695-1a31-4499-88ae-e847036fd7e3","published":"2026-09-23T13:17:32.143","lastModified":"2026-10-07T15:30:58.957","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply."}],"affected":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","affectedData":[{"vendor":"WatchGuard","product":"AuthPoint Authentication Gateway","defaultStatus":"unaffected","versions":[{"version":"4.2.2","lessThan":"7.5.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:24:44.392517Z","id":"CVE-2026-95676","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","type":"Secondary","description":[{"lang":"en","value":"CWE-287"},{"lang":"en","value":"CWE-636"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:watchguard:authentication_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.2","versionEndExcluding":"7.5.1","matchCriteriaId":"4B2BE157-2746-499C-B7A9-0D37A842871A"}]}]}],"references":[{"url":"https://psirt.watchguard.com/CVE-2026-95676","source":"5d1c2695-1a31-4499-88ae-e847036fd7e3","tags":["Patch","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-12974","sourceIdentifier":"psirt@forcepoint.com","published":"2026-09-23T14:17:06.547","lastModified":"2026-09-23T17:58:26.570","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW).\n\n\nThis issue affects Forcepoint Security Engine (NGFW): from 7.1.0 through 7.1.13, from 7.3.0 through 7.3.1, 7.3.3, from 7.4.0 through 7.4.1, and 7.5.0."}],"affected":[{"source":"psirt@forcepoint.com","affectedData":[{"vendor":"Forcepoint","product":"Forcepoint Security Engine (NGFW)","defaultStatus":"unaffected","versions":[{"version":"7.1.0","lessThanOrEqual":"7.1.13","versionType":"semver","status":"affected"},{"version":"7.3.0","lessThanOrEqual":"7.3.1","versionType":"semver","status":"affected"},{"version":"7.3.3","versionType":"semver","status":"affected"},{"version":"7.4.0","lessThanOrEqual":"7.4.1","versionType":"semver","status":"affected"},{"version":"7.5.0","versionType":"custom","status":"affected"},{"version":"7.3.2","versionType":"custom","status":"unaffected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"psirt@forcepoint.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.9,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"ATTACKED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:23:42.713648Z","id":"CVE-2026-12974","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@forcepoint.com","type":"Secondary","description":[{"lang":"en","value":"CWE-183"},{"lang":"en","value":"CWE-1284"}]}],"references":[{"url":"https://support.forcepoint.com/s/article/Security-Advisory-Security-Policy-Bypass-in-Forcepoint-Security-Engine-NGFW-CVE-2026-12974","source":"psirt@forcepoint.com"}]}},{"cve":{"id":"CVE-2026-18177","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T14:17:07.660","lastModified":"2026-10-07T13:03:55.270","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:18:37.954474Z","id":"CVE-2026-18177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-18179","sourceIdentifier":"psirt@us.ibm.com","published":"2026-09-23T14:17:07.783","lastModified":"2026-10-07T13:03:53.020","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization."}],"affected":[{"source":"psirt@us.ibm.com","affectedData":[{"vendor":"IBM","product":"Financial Transaction Manager (FTM) for RedHat OpenShift","cpes":["cpe:2.3:a:ibm:financial_transaction_manager_ftmfor_redhat_openshift:4.0.6.0:*:*:*:*:*:*:*"],"versions":[{"version":"4.0.6.0","lessThanOrEqual":"4.0.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:17:01.741086Z","id":"CVE-2026-18179","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"psirt@us.ibm.com","type":"Secondary","description":[{"lang":"en","value":"CWE-862"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:*:*:*:*:*:-:*:*","versionStartIncluding":"4.0.7.0","versionEndExcluding":"4.0.11.0","matchCriteriaId":"9335C1AB-452D-471E-AA03-7B44907FFC75"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:-:*:*:*:-:*:*","matchCriteriaId":"3A5AB1EE-ED01-4DC0-B0C1-E15D2E95130D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_1:*:*:*:-:*:*","matchCriteriaId":"A49158DE-E228-4E36-8D62-A1367E94BCC8"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_2:*:*:*:-:*:*","matchCriteriaId":"E302AC19-F7C6-436F-AC64-20CBFA981919"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_3:*:*:*:-:*:*","matchCriteriaId":"7D95FBBD-6AFD-4045-B533-038533DBF766"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_4:*:*:*:-:*:*","matchCriteriaId":"586D6C18-B7A8-4919-B6FA-FE4472202F5F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_5:*:*:*:-:*:*","matchCriteriaId":"7DC8A48F-3578-4DF6-B415-919706933068"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:financial_transaction_manager:4.0.6.0:interim_fix_6:*:*:*:-:*:*","matchCriteriaId":"E1E4A18E-0418-49EB-8E51-6C9B9FA35D7F"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*","matchCriteriaId":"F08E234C-BDCF-4B41-87B9-96BD5578CBBF"}]}]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7288641","source":"psirt@us.ibm.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-59167","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T14:17:07.923","lastModified":"2026-09-24T15:17:25.303","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"JiHong88","product":"suneditor","versions":[{"version":"< 2.47.11","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:24:21.114425Z","id":"CVE-2026-59167","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://github.com/JiHong88/suneditor/commit/a94ace269c7102bfb6de58a27a6547bc4eb09045","source":"security-advisories@github.com"},{"url":"https://github.com/JiHong88/suneditor/issues/1646","source":"security-advisories@github.com"},{"url":"https://github.com/JiHong88/suneditor/releases/tag/2.47.11","source":"security-advisories@github.com"},{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4","source":"security-advisories@github.com"},{"url":"https://github.com/JiHong88/suneditor/security/advisories/GHSA-6rf4-v2fh-m6p4","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-86677","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:08.803","lastModified":"2026-09-24T04:18:03.010","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182100","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-86677","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-89"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86677.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86678","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:08.963","lastModified":"2026-09-24T04:18:03.127","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182100","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-86678","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86678.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86679","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:09.090","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182100","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T13:40:04.396312Z","id":"CVE-2026-86679","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86679.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86681","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:09.217","lastModified":"2026-09-23T18:17:31.543","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182300","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":2.8,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:24:19.923123Z","id":"CVE-2026-86681","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86681.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86683","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:09.347","lastModified":"2026-09-24T04:18:03.250","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182100","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-86683","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-20"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86683.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-86708","sourceIdentifier":"0fc0942c-577d-436f-ae8e-945763c79b02","published":"2026-09-23T14:17:09.467","lastModified":"2026-09-24T04:18:03.367","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources."}],"affected":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","affectedData":[{"vendor":"Zohocorp","product":"ManageEngine Applications Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"182300","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-86708","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","description":[{"lang":"en","value":"CWE-321"}]}],"references":[{"url":"https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86708.html","source":"0fc0942c-577d-436f-ae8e-945763c79b02"}]}},{"cve":{"id":"CVE-2026-96512","sourceIdentifier":"secalert@redhat.com","published":"2026-09-23T14:17:10.747","lastModified":"2026-10-22T06:17:15.710","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Because sudo is a setuid-root program, an unprivileged local user can set TZ to an extreme timezone offset to shift the authorization window by up to approximately 25 hours, causing expired rules to be treated as valid. This allows the user to execute commands outside the intended time window. Authentication is not bypassed; only the time-based authorization check is affected."}],"affected":[{"source":"secalert@redhat.com","affectedData":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:enterprise_linux:10.2"],"versions":[{"version":"0:1.9.17-10.p2.el10_2.7","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"],"versions":[{"version":"0:1.9.15-8.p5.el10_0.5","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:enterprise_linux:8::baseos"],"versions":[{"version":"0:1.9.5p2-2.el8_10","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"versions":[{"version":"0:1.9.5p2-1.el8_8.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:rhel_e4s:8.8::baseos","cpe:/o:redhat:rhel_tus:8.8::baseos"],"versions":[{"version":"0:1.9.5p2-1.el8_8.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"versions":[{"version":"0:1.9.17p2-3.el9_8.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/o:redhat:enterprise_linux:9::baseos"],"versions":[{"version":"0:1.9.17p2-3.el9_8.3","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/a:redhat:rhel_e4s:9.4::appstream","cpe:/o:redhat:rhel_e4s:9.4::baseos"],"versions":[{"version":"0:1.9.5p2-10.el9_4.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/a:redhat:rhel_eus:9.6::appstream","cpe:/o:redhat:rhel_eus:9.6::baseos"],"versions":[{"version":"0:1.9.5p2-10.el9_6.4","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Hardened Images","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"sudo-main","cpes":["cpe:/a:redhat:hummingbird:1"],"versions":[{"version":"1.9.17-16.p2.2.hum1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"rhui5/installer-rhel9","cpes":["cpe:/a:redhat:rhui:5::el9"],"versions":[{"version":"1791964013","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Update Infrastructure 5","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"rhui5/rhua-rhel9","cpes":["cpe:/a:redhat:rhui:5::el9"],"versions":[{"version":"1791978693","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sudo","cpes":["cpe:/o:redhat:enterprise_linux:7"]}]}],"metrics":{"cvssMetricV31":[{"source":"secalert@redhat.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-96512","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"secalert@redhat.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71609","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75571","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75579","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75580","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82939","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86633","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86634","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:86635","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:87026","source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-96512","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2539327","source":"secalert@redhat.com"},{"url":"https://github.com/sudo-project/sudo/commit/1820a349687522f51023d1ae5925125f59679a8c","source":"secalert@redhat.com"},{"url":"http://www.openwall.com/lists/oss-security/2026/09/24/4","source":"af854a3a-2127-422b-91ae-364da2661108"}]}},{"cve":{"id":"CVE-2026-96559","sourceIdentifier":"5a6e4751-2f3f-4070-9419-94fb35b644e8","published":"2026-09-23T14:17:10.900","lastModified":"2026-09-23T14:17:10.900","vulnStatus":"Rejected","cveTags":[],"descriptions":[{"lang":"en","value":"Rejected reason: This ID was for testing"}],"metrics":{},"references":[]}},{"cve":{"id":"CVE-2026-96560","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-09-23T14:17:11.073","lastModified":"2026-09-23T17:17:49.440","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"ModelTC","product":"LightLLM","defaultStatus":"unaffected","packageName":"LightLLM","repo":"https://github.com/ModelTC/lightllm","packageURL":"pkg:github/ModelTC/lightllm","versions":[{"version":"0","lessThanOrEqual":"1.2.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T14:30:06.350499Z","id":"CVE-2026-96560","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-502"}]}],"references":[{"url":"https://github.com/ModelTC/LightLLM/issues/1590","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/kv_transporter.py#L20-L36","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L247-L249","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L411-L415","source":"disclosure@vulncheck.com"},{"url":"https://github.com/ModelTC/lightllm/blob/v1.2.0/lightllm/server/router/model_infer/mode_backend/pd/nccl_kv_transporter.py#L437-L461","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/lightllm-through-1.2.0-unauthenticated-remote-code-execution-via-nccl-pd-rpyc-control-channel","source":"disclosure@vulncheck.com"}]}},{"cve":{"id":"CVE-2026-55610","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:14.580","lastModified":"2026-09-23T20:17:11.580","vulnStatus":"Awaiting Analysis","cveTags":[],"descriptions":[{"lang":"en","value":"InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company — it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"InvoiceShelf","product":"InvoiceShelf","versions":[{"version":"< 2.4.1","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:14:01.010220Z","id":"CVE-2026-55610","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-639"}]}],"references":[{"url":"https://github.com/InvoiceShelf/InvoiceShelf/security/advisories/GHSA-vgx6-6cqr-m8qr","source":"security-advisories@github.com"}]}},{"cve":{"id":"CVE-2026-61413","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:14.867","lastModified":"2026-09-25T13:36:02.150","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-61413","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-269"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-61834","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.127","lastModified":"2026-09-23T17:17:15.923","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such as toString can therefore traverse into a shared built-in function object and add attacker-controlled properties, causing process-global mutation that may affect application logic reading inherited-method properties. This issue is fixed in version 0.9.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"thomaspoignant","product":"scim-patch","versions":[{"version":"< 0.9.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T16:20:07.829094Z","id":"CVE-2026-61834","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-915"},{"lang":"en","value":"CWE-1321"}]}],"references":[{"url":"https://github.com/thomaspoignant/scim-patch/commit/c86474f7a9b16191d939f59ba94eca6c6e63044b","source":"security-advisories@github.com"},{"url":"https://github.com/thomaspoignant/scim-patch/pull/1127","source":"security-advisories@github.com"},{"url":"https://github.com/thomaspoignant/scim-patch/releases/tag/v0.9.2","source":"security-advisories@github.com"},{"url":"https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-2mhw-wcx5-v3xj","source":"security-advisories@github.com"},{"url":"https://github.com/thomaspoignant/scim-patch/security/advisories/GHSA-2mhw-wcx5-v3xj","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}},{"cve":{"id":"CVE-2026-62998","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.293","lastModified":"2026-10-19T19:37:26.643","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"redaxo","product":"core","versions":[{"version":"< 5.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:22:29.404424Z","id":"CVE-2026-62998","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-200"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21.2","matchCriteriaId":"AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E"}]}]}],"references":[{"url":"https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/redaxo/core/pull/6580","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63000","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.453","lastModified":"2026-10-19T20:35:09.623","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"redaxo","product":"core","versions":[{"version":"< 5.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":1.6,"impactScore":4.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-29T01:56:03.005133Z","id":"CVE-2026-63000","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21.2","matchCriteriaId":"AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E"}]}]}],"references":[{"url":"https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/redaxo/core/pull/6579","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63001","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.617","lastModified":"2026-10-19T20:35:19.627","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"redaxo","product":"core","versions":[{"version":"< 5.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T18:17:12.653764Z","id":"CVE-2026-63001","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21.2","matchCriteriaId":"AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E"}]}]}],"references":[{"url":"https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/redaxo/core/pull/6581","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-63002","sourceIdentifier":"security-advisories@github.com","published":"2026-09-23T15:17:15.770","lastModified":"2026-10-19T20:36:13.477","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"redaxo","product":"core","versions":[{"version":"< 5.21.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-24T14:26:05.685430Z","id":"CVE-2026-63002","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*","versionEndExcluding":"5.21.2","matchCriteriaId":"AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E"}]}]}],"references":[{"url":"https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/redaxo/core/pull/6581","source":"security-advisories@github.com","tags":["Issue Tracking","Patch"]},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-71177","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:16.457","lastModified":"2026-09-25T13:35:54.867","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session theft."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T15:22:57.501182Z","id":"CVE-2026-71177","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1021"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-71178","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:16.590","lastModified":"2026-09-26T23:16:34.830","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","baseScore":3.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-26T22:38:49.901728Z","id":"CVE-2026-71178","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-647"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73586","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:17.583","lastModified":"2026-09-25T13:35:41.337","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L","baseScore":6.4,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"LOW"},"exploitabilityScore":0.9,"impactScore":5.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-73586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73587","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:17.720","lastModified":"2026-09-25T13:35:34.083","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-73587","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-295"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-73588","sourceIdentifier":"security_alert@emc.com","published":"2026-09-23T15:17:17.850","lastModified":"2026-09-25T13:35:26.967","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access."}],"affected":[{"source":"security_alert@emc.com","affectedData":[{"vendor":"Dell","product":"Secure Connect Gateway (SCG) Policy Manager","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"5.36.00.16 or later","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security_alert@emc.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-23T00:00:00+00:00","id":"CVE-2026-73588","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security_alert@emc.com","type":"Secondary","description":[{"lang":"en","value":"CWE-306"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"5.36.00.16","matchCriteriaId":"64C25254-BDDD-4A1B-8A86-E478C32604AE"}]}]}],"references":[{"url":"https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9","source":"security_alert@emc.com","tags":["Vendor Advisory"]}]}}]}